Datasheet ST25TV02KC, ST25TV512C Datasheet (STMicroelectronics)

Download

Page 1

ST25TV02KC ST25TV512C

Datasheet

NFC Type 5 / RFID tag IC with up to 2.5 Kbits of EEPROM, product identification

and protection

Features

Includes ST state-of-the-art patented technology

Contactless interface

UFDFPN5

1.7 x 1.4 mm

Wafer

Product status link

ST25TV02KC

ST25TV512C

• Compliant with ISO/IEC 15693

• NFC Forum Type 5 tag certified by the NFC Forum

• Supports all ISO/IEC 15693 modulations, coding, subcarrier modes, and datarates up to 26 Kbit/s

• Single block reads and writes, multiple block reads

• Internal tuning capacitance: 23 pF

Memory

• Up to 2560 bits (320 bytes) of EEPROM

• Accessible by blocks of four bytes

• Write time from RF: typical 5 ms per block

• Data retention: 60 years at 55°C

• Minimum endurance: 100k write cycles

• 3-digit unique tap code

• Augmented NDEF (contextual automatic NDEF message)

Data protection

• User memory configurable in one or two areas:

– in single area mode, access protectable by one 64-bit password

– in flexible dual area mode, access protectable by two 32-bit passwords

• System configuration: access protected by a 32-bit password

• Permanent write lock of specific user area blocks

• Temporary write lock at user area level

• Permanent write lock of specific system configuration blocks

Product identification and protection

• Password features: cover coding, recovery, failed attempt counter

• Tamper detection capability with memorization of open/resealed events

• TruST25 digital signature

Privacy

• Configurable kill mode for permanent deactivation of the tag

• Untraceable mode with configurable responsiveness

Temperature range

• From - 40 to 85 °C

DS13304 - Rev 3 - April 2021 For further information contact your local STMicroelectronics sales office.

www.st.com

Page 2

ST25TV02KC ST25TV512C

Package

• 5-pin package, ECOPACK2 (RoHS compliant)

• Bumped and sawn wafer

DS13304 - Rev 3

page 2/87

Page 3

1 Description

The ST25TV02KC and ST25TV512C devices are NFC/RFID tag ICs with an Augmented NDEF feature, a tamper detection interface, and specific modes to protect customer privacy.

The Augmented NDEF feature is a contextual automatic NDEF message service, allowing the tag to respond dynamic content without an explicit update of the EEPROM by the end-user.

The tamper detection interface is available on ST25TV02KC-T devices only. This interface is not available on ST25TV02KC‑A and ST25TV512C devices.

The ST25TV02KC and ST25TV512C devices hold a digital signature generated by TruST25 (a set of software and procedures) to prove the origin of the chip in cloning detection, embeds a configurable EEPROM with 60-year data retention, and can be operated from a 13.56 MHz long range RFID reader or an NFC phone.

The contactless interface is compliant with the ISO/IEC 15693 standard and NFC Forum Type 5 tag specification.

1.1 Block diagram

The ST25TV02KC and ST25TV512C (hereinafter referred to as ST25TVxxxC) devices are depicted in the following block diagram:

ST25TV02KC ST25TV512C

Description

Figure 1. ST25TVxxxC block diagram

ANALOG FRONT END

EEPROM

RF interface

AC0

23 pF tuning

capacitance

User memory

(2)

DIGITAL CONTROL

UNIT

AC1

ISO/IEC 15693

protocol and control

Memory control

System registers

1. The tamper detection interface is available on ST25TV02KC-T devices only.

2. Respectively 512 and 2560 bits on ST25TV512C and ST25TV02KC devices.

(1)

TD0

TD1

TAMPER DETECTION

1.2 Package connections

ST25TV02KC and ST25TV512C are provided in two delivery forms:

• UFDFPN5 package (ST25TV02KC-T devices only)

• Sawn and bumped wafer (ST25TV512C, ST25TV02KC-A and ST25TV02KC-T devices)

DS13304 - Rev 3

page 3/87

Page 4

ST25TV02KC ST25TV512C

Package connections

Table 1. Signal names

Signal name Function Direction

AC0 Antenna coils In-out

AC1 Antenna coils In-out

TD0 Tamper detection loop In

TD1 Tamper detection loop Out

Figure 2. UFDFPN5 package connections

TD1

5 1

AC1

UFDFPN5 pads side

Figure 3. Die connections for sawn and bumped wafer

AC0 NC

ST25TVxxxC-A

AC1 NC

Bumped pads side

TD0

AC0

AC0 TD0

ST25TV02KC-T

AC1 TD1

Bumped pads side

DS13304 - Rev 3

page 4/87

Page 5

2 Signal descriptions

2.1 Antenna coil (AC0, AC1)

These inputs are used to connect the ST25TVxxxC device to an external coil exclusively. It is advised not to connect any other DC or AC path to AC0 or AC1.

When correctly tuned, the coil is used to power and access the device using the ISO/IEC 15693 and ISO 18000-3 mode 1 protocols.

2.2 Tamper detection (TD0, TD1)

These inputs are used to connect a wire loop to the ST25TVxxxC device to detect an open or a short between the TD0 and TD1 pins.

ST25TV02KC ST25TV512C

Signal descriptions

DS13304 - Rev 3

page 5/87

Page 6

3 Power management

The ST25TVxxxC device is powered through its contactless interface.

3.1 Device set

To ensure a proper boot of the RF circuitry, the RF field must be turned ON without any modulation for a minimum period of time t

all received RF commands (see Figure 4).

RF Field:

BOOT_RF

(see Table 172. RF characteristics). During t

Figure 4. RF power-up sequence

BOOT_RF

ST25TV02KC ST25TV512C

Power management

BOOT_RF

, the ST25TVxxxC ignores

RF State:

3.2 Device reset

To ensure a proper reset of the RF circuitry, the RF field must be turned off (100% modulation) for a minimum t

amount of time (see Table 172. RF characteristics).

RF_OFF

OFF

Boot

No RF access

allowed

ON = RF interface ready

DS13304 - Rev 3

page 6/87

Page 7

4 Memory management

4.1 Memory organization

The ST25TVxxxC memory is organized as follows:

• User memory: it can be configured in one or two different areas, as described in Section 4.2 User memory. Those areas can be used for user data and NFC Forum Type 5 Capability Container (CC) if required.

• System configuration memory: it is composed of different registers, including the device configuration, the ISO15693 AFI and DSFID registers. It also contains the UID and different protection registers. Refer to

Section 4.3 System conﬁguration memory for more details

ST25TV02KC ST25TV512C

Memory management

Figure 5. Memory organization

User memory

(3)

CC File

AREA1

(single area)

(1)

AREA1

(dual area)

AREA2

(dual area)

(2)

DS13304 - Rev 3

System

CFG

configuration

memory

1. NFC Forum T5T CC file is coded on block 00h which is part of AREA1.

2. In dual area mode, the AREA1/AREA2 boundary can be configured with a block granularity.

3. Respectively 16 and 80 blocks of 32 bits for ST25TV512C and ST25TV02KC devices.

SYS

page 7/87

Page 8

4.2 User memory

User memory is addressed as blocks (= pages) of 4 bytes, starting at address 0 and ending at address END_MEM. Value of END_MEM is 0Fh and 4Fh for ST25TV512C and ST25TV02KC devices respectively. The ST25TVxxxC user memory can be configured in single area (AREA1) or in dual area mode (AREA1 and AREA2) depending on the value of the END_A1 register at the start of a RF session (see Table 2. User memory in single

area mode, Table 3. User memory in dual area mode and Table 13. END_A1 content).

When the value of END_A1 is equal to END_MEM, the ST25TVxxxC user memory is configured in single area mode defined as follows:

• AREA1 starts at address 00h. It is composed of (END_MEM+1) blocks. It can be read- or readwriteprotected by a dedicated 64-bit password. AREA1 is dedicated to user data.

When the value of END_A1 is lower than END_MEM, the ST25TVxxxC user memory is configured in dual area mode defined as follows :

• AREA1 starts at address 00h. It is composed of (END_A1+1) blocks. It can be read- or readwrite-protected by a dedicated 32-bit password. AREA1 is dedicated to user data.

• AREA2 starts at address (END_A1+1). It is composed of (END_MEM-END_A1) blocks. It can be read- or readwrite-protected by a dedicated 32-bit password. AREA2 is dedicated to user data.

Block 00h belongs to AREA1, but can always be read regardless of the read-protection mode of AREA1. This block is dedicated to the CC file content defined by the NFC Forum Type 5 application. An application that does not need to comply with NFC Forum Type 5 specifications can use block 00h for any purpose.

ST25TV02KC ST25TV512C

User memory

Table 2. User memory in single area mode

RF command

ReadSingleBlock

ReadMultipleBlocks

WriteSingleBlock

Block

address

(1)

00h

LSByte - - MSByte

0000h 0001h 0002h 0003h

01h 0004h 0005h 0006h 0007h

02h 0008h 0009h 000Ah 000Bh

... ... ... ... ...

END_MEM END_MEM*4+0 END_MEM*4+1 END_MEM*4+2 END_MEM*4+3

1. Block 00h is always readable

2. For single area mode, set the value of END_A1 register to END_MEM

Byte address

Table 3. User memory in dual area mode

RF command

Block

address

(1)

00h

LSByte - - MSByte

0000h 0001h 0002h 0003h

01h 0004h 0005h 0006h 0007h

02h 0008h 0009h 000Ah 000Bh

ReadSingleBlock

ReadMultipleBlocks

WriteSingleBlock

... ... ... ... ...

END_A1 END_A1*4+0 END_A1*4+1 END_A1*4+2 END_A1*4+3

END_A1+1 END_A1*4+4 END_A1*4+5 END_A1*4+6 END_A1*4+7

... ... ... ... ...

END_MEM END_MEM*4+0 END_MEM*4+1 END_MEM*4+2 END_MEM*4+3

1. Block 00h is always readable

2. For dual area mode, set value of END_A1 register between 00h and (END_MEM-1)

Byte address

Comment

(2)

AREA1

Comment

(2)

AREA1

(2)

AREA2

DS13304 - Rev 3

page 8/87

Page 9

4.3 System conﬁguration memory

In addition to user memory, ST25TVxxxC includes a set of registers located in the system conﬁguration memory. Registers are read during the boot sequence and deﬁne basic ST25TVxxxC behaviour.

4.3.1 System conﬁguration registers

Table 4. List of conﬁguration registers lists the configuration registers of the ST25TVxxxC device. They are

accessed with the ReadConfiguration and WriteConfiguration commands and two arguments FID and PID, respectively acting as a feature identifier and a parameter identifier.

The write access to the configuration registers is protected by the CONFIG security session which is opened by a successful presentation of the PWD_CFG password (see Section 5.1.2 Password management).

Configuration registers are grouped by FID value. The write access to a group of registers may be permanently locked.

Depending on the configuration register, its read access is either always granted or protected with the same mechanisms as its write access.

Depending on the configuration register, when its content is updated during a RF session, the effect of the new value is activated either immediately or at the start of the next RF session.

Table 4. List of conﬁguration registers

Name

RW_PROTECTION_A1 00h 00h 1 Y W B Section 5.1.1

END_A1 00h 01h 1 Y W' B Section 5.1.1

RW_PROTECTION_A2 01h 00h 1 Y W B Section 5.1.1

UTC_EN 02h 00h 1 Y W B Section 5.2.1

UTC 02h 01h 3 Y N - Section 5.2.1

TD_EVENT_UPDATE_EN

TD_SEAL_MSG

TD_UNSEAL_MSG

TD_RESEAL_MSG

TD_SHORT_MSG

TD_OPEN_MSG

TD_STATUS

(4)

ANDEF_EN 04h 00h 1 Y W B Section 5.4.1

ANDEF_CFG 04h 01h 2 Y W B Section 5.4.1

ANDEF_SEP 04h 02h 1 R W I Section 5.4.1

ANDEF_CUSTOM_LSB 04h 03h 4 R W I Section 5.4.1

ANDEF_CUSTOM_MSB 04h 04h 4 R W I Section 5.4.1

PRIVACY 05h 00h 1 Y W B Section 5.5.1

AFI_PROT 08h 00h 1 Y W B Section 5.7.1

REV FEh 00h 1 Y N - Section 5.9

UID FEh 01h 8 Y N - Section 5.9

LCK_CONFIG FFh 00h 2 Y W'' I Section 5.1.1

1. Y: read access not protected, R: read access granted if LCK_CONFIG[FID]=0b and CONFIG security session open

2. N: write access not available, W: write access granted if LCK_CONFIG[FID]=0b and CONFIG security session open, W':

write access granted if LCK_CONFIG[1:0]=00b and CONFIG security session open, W'': write access granted if CONFIG security session open

3. B: update is effective on next RF boot sequence, I: update is effective immediately

FID PID Bytes

(4)

03h 00h 1 Y W B Section 5.3.1

03h 01h 2 R W I Section 5.3.1

03h 02h 2 R W I Section 5.3.1

03h 03h 2 R W I Section 5.3.1

03h 04h 1 R W I Section 5.3.1

03h 05h 1 R W I Section 5.3.1

03h 06h 3 Y N - Section 5.3.1

Read

ST25TV02KC ST25TV512C

System conﬁguration memory

(1)

Write

(2)

Activation time

(3)

Section

DS13304 - Rev 3

page 9/87

Page 10

4. Registers with FID=03h are available only on ST25TV02KC-T devices (see section 10)

4.3.2 System registers

Table 5 lists the system registers of the ST25TVxxxC device. They are accessed with other RF commands than

ReadConfiguration and WriteConfiguration.

When the write access to a system register is available, it may be protected by a password and/or a lock mechanism.

When the read access to a system register is available, it is always granted through the relevant RF command.

When the content of a system register is updated, the effect of the new value is activated immediately.

Name Bytes

LCK_BLOCK 10 R W I Section 5.1.1

LCK_DSFID 1 N W I Section 5.9

LCK_AFI 1 N W I Section 5.9

DSFID 1 Y W I Section 5.9

AFI 1 Y W I Section 5.9

IC_REF 1 Y N - Section 5.9

UID 8 Y N - Section 5.9

ANDEF_UID 16 Y N - Section 5.4.1

KILL_CMD 1 N W I Section 5.5.1

UNTR_CMD 1 N W I Section 5.5.1

RND_NUMBER 2 Y

PWD_CFG 4 N W I Section 5.1.1

PWD_A1 4 N W I Section 5.1.1

PWD_A2 4 N W I Section 5.1.1

PWD_UNTR 4 N W I Section 5.1.1

1. Y: read access granted without condition, R: read access granted with condition

2. N: write access not available, W: write access granted with condition

3. The content of the RND_NUMBER register is updated internally on a successful GetRandomNumber request

Table 5. List of system registers

Read

(1)

Write

(2)

(3)

Activation time Section

ST25TV02KC ST25TV512C

System conﬁguration memory

- Section 5.1.1

DS13304 - Rev 3

page 10/87

Page 11

5 Specific features

ST25TVxxxC offers the following features:

• Section 5.1 Data protection

• Section 5.2 Unique tap code

• Section 5.3 Tamper detection

• Section 5.4 Augmented NDEF

• Section 5.5 Consumer privacy protection

• Section 5.6 TruST25 digital signature

• Section 5.7 AFI protection

• Section 5.8 Inventory Initiated

The features from Section 5.1 to Section 5.7 can be programmed by accessing registers of the ST25TVxxxC using the ReadConfiguration and WriteConfiguration commands. Update of configuration registers is only possible when the access right has been granted by presenting the configuration password (PWD_CFG), and if the configuration of the feature was not previously locked (see register LCK_CONFIG).

Depending on the configuration register, the effect of a valid write access may be applied immediately or during the boot sequence of the next RF session.

An additional set of registers allows to identify and customize the product (see Section 5.9 Device identiﬁcation

registers.).

ST25TV02KC ST25TV512C

Specific features

5.1 Data protection

ST25TVxxxC provides a special data protection mechanism based on passwords that unlock security sessions.

Read and/or write access to the user memory can be protected. Write access to the conﬁguration registers is always protected. Read access to some conﬁguration registers is protected.

Other lock mechanisms are supported (LockBlock, lock by feature), as described in this section.

5.1.1 Data protection registers

RF Command Access type

ReadConfiguration @(FID=FFh, PID=00h) R : always possible

WriteConfiguration @(FID=FFh, PID=00h)

Table 6. LCK_CONFIG access

W : if the CONFIG security session is open

W effective time : immediate

DS13304 - Rev 3

page 11/87

Page 12

ST25TV02KC ST25TV512C

Data protection

Table 7. LCK_CONFIG content

Bit Name Function Factory value

b0 LCK_A1

b1 LCK_A2

b2 LCK_UTC

b3 LCK_TD

b4 LCK_ANDEF

b5 LCK_PRIV

b7-b6 RFU - 00b

b8 LCK_AFIP

b15-b9 RFU - 0000000b

0: configuration registers with FID=00h are not locked

1: configuration registers with FID=00h are locked

0: configuration registers with FID=01h are not locked

1: configuration registers with FID=01h are locked

0: configuration registers with FID=02h are not locked

1: configuration registers with FID=02h are locked

0: configuration registers with FID=03h are not locked

1: configuration registers with FID=03h are locked

0: configuration registers with FID=04h are not locked

1: configuration registers with FID=04h are locked

0: configuration registers with FID=05h are not locked

1: configuration registers with FID=05h are locked

0: configuration registers with FID=08h are not locked

1: configuration registers with FID=08h are locked

Note: Refer to Table 4. List of conﬁguration registers for the LCK_CONFIG register.

If value 1b is issued for a field already set to 1b, the WriteConfiguration command has no effect and error 11h shall be responded.

Otherwise, if value 0b is issued for a field set to 1b, the corresponding feature remains locked and no errorcode is responded to the WriteConfiguration command.

Table 8. LCK_BLOCK access

RF Command

ReadSingleBlock

ReadMultipleBlocks

GetMultipleBlockSecurityStatus

R : if Option_flag=1 and write access to parent area is allowed

R : if write access to parent area is allowed

LockBlock W : if not already locked and write access to parent area is allowed

- W effective time : immediate

1. When the write access to an area is not allowed (write access forbidden, or protected with closed security session),

then the value of LCK_BLOCK is masked by 1 in a BSS field (see sections Section 6.4.3 ReadSingleBlock,

Section 6.4.6 ReadMultipleBlocks and Section 6.4.14 GetMultipleBlockSecurityStatus)

Access type

Table 9. LCK_BLOCK content

Bit

b79-b0 LCK_BLOCK

Name Function Factory Value

For each bit bN:

• 0: write access of block N not locked

• 1: write access of block N permanently

(1)

Note: Refer to Table 5. List of system registers for the LCK_BLOCK register.

DS13304 - Rev 3

page 12/87

Page 13

ST25TV02KC ST25TV512C

Data protection

Table 10. RW_PROTECTION_A1 access

RF Command Type

ReadConfiguration @(FID=00h, PID=00h) R : always possible

WriteConfiguration @(FID=00h, PID=00h)

Table 11. RW_PROTECTION_A1 content

Bit Name Function Factory Value

AREA1 access rights (except block 00h):

• 00: read always allowed / write always allowed

• 01: read always allowed / write allowed if AREA1 security

• 10: read allowed if AREA1 security session is open /

b1-b0 RW_PROTECTION_A1

b7-b2 RFU - 000000b

• 11: read allowed if AREA1 security session is open /

Block 00h access rights: read always allowed

• 00: write always allowed

• 01: write allowed if AREA1 security session is open

• 10: write allowed if AREA1 security session is open

• 11: write forbidden

W : if the CONFIG security session is open and LCK_A1=0b

W effective time : on next RF boot sequence

session is open

write allowed if AREA1 security session is open

write forbidden

00b

Note: Refer to Table 4. List of conﬁguration registers for the RW_PROTECTION_A1 register.

Table 12. END_A1 access

RF command

ReadConfiguration @(FID=00h, PID=01h) R : always possible

WriteConfiguration @(FID=00h, PID=01h)

W : if the CONFIG security session is open and LCK_A1=LCK_A2=0b

W effective time : on next RF boot sequence

Access type

Table 13. END_A1 content

Bit

b7-b0 END_A1

1. END_MEM value is 0Fh / 4Fh for ST25TV512C / ST25TV02KC devices respectively.

Name Function Factory Value

Number of the last block belonging to AREA1.

When lower than END_MEM, user memory is split in two areas :

• AREA1 (blocks 00h to END_A1)

• AREA2 (blocks END_A1 + 1 to END_MEM).

Otherwise user memory contains a single area : AREA1 (blocks 00h to END_MEM)

Note: Refer to Table 4. List of conﬁguration registers for the END_A1 register.

END_MEM

(1)

DS13304 - Rev 3

page 13/87

Page 14

ST25TV02KC ST25TV512C

Data protection

Table 14. RW_PROTECTION_A2 access

RF command Access type

ReadConfiguration @(FID=01h, PID=00h) R : always possible

WriteConfiguration @(FID=01h, PID=00h)

Table 15. RW_PROTECTION_A2 content

Bit Name Function Factory Value

AREA2 access rights:

• 00: read always allowed / write always allowed

• 01: read always allowed / write allowed if AREA2 security

b1-b0 RW_PROTECTION_A2

b7-b2 RFU - 000000b

session is open

• 10: read allowed if AREA2 security session is open / write allowed if AREA2 security session is open

• 11: read allowed if AREA2 security session is open / write not allowed

W : if the CONFIG security session is open and LCK_A2=0b

W effective time : on next RF boot sequence

00b

Note: Refer to Table 4. List of conﬁguration registers for the RW_PROTECTION_A2 register.

Table 16. PWD_CFG access

RF command

- R: no read access

WritePassword @PID=00h

W: if the CONFIG security session is open

W effective time: immediate

Access type

Table 17. PWD_CFG content

Bit Name Function

b31-b0 PWD_CFG Password for access to configuration registers and Kill command 00000000h

Note: Refer to Table 5. List of system registers for the PWD_CFG register.

Factory

Value

DS13304 - Rev 3

page 14/87

Page 15

Table 18. PWD_A1 access

RF command Access type

- R : no read access

WritePassword @PID=01h

W : if AREA1 security session is open

W effective time : immediate

Table 19. PWD_A1 content

Bit Name Function Factory Value

b31-b0 PWD_A1_LSB Password for access to AREA1 00000000h

In single area mode, bits 0 to 63 are used.

(1)

In dual area mode only bits 0 to 31 are used

b63-b32

PWD_A1_MSB

1. PWD_A1_MSB is an alias of register PWD_A2:

• when switching from dual to single area mode, the value of PWD_A1_MSB is the latest known value of PWD_A2

• when switching from single to dual area mode, the value of PWD_A2 is the latest known value of PWD_A1_MSB

Note: Refer to Table 5. List of system registers for the PWD_A1 register.

ST25TV02KC ST25TV512C

Data protection

00000000h

Table 20. PWD_A2 access

RF command

- R : no read access

WritePassword @PID=02h

W : if AREA2 security session is open

W effective time : immediate

Table 21. PWD_A2 content

Bit

b31-b0

1. PWD_A1_MSB is an alias of register PWD_A2:

• when switching from dual to single area mode, the value of PWD_A1_MSB is the latest known value of PWD_A2

• when switching from single to dual area mode, the value of PWD_A2 is the latest known value of PWD_A1_MSB

Name Function Factory Value

PWD_A2

(1)

Password for access to AREA2 00000000h

Note: Refer to Table 5. List of system registers for the PWD_A2 register.

Table 22. PWD_UNTR access

RF command

- R : no read access

WritePassword @PID=03h

W : if UNTR security session is open

W effective time : immediate

Access type

Table 23. PWD_UNTR content

Bit

b31-b0 PWD_UNTR Password used with ToggleUntraceable command 00000000h

Name Function Factory Value

Note: Refer to Table 5. List of system registers for the PWD_UNTR register.

DS13304 - Rev 3

page 15/87

Page 16

Table 24. RND_NUMBER access

RF command Access type

GetRandomNumber R : always possible

1. the content of the RND_NUMBER register is updated internally on a successful GetRandomNumber command.

W : no write access

Table 25. RND_NUMBER content

Bit Name Function Factory value

b15-b0 RND_NUMBER 16-bit random number N/A

Note: Refer to Table 5. List of system registers for the RND_NUMBER register.

5.1.2 Password management

ST25TVxxxC provides protection of user and system configuration memories. Access to groups of data are controlled by security sessions based on passwords. On successful (respectively failed) presentation of a password, a security session is open (respectively closed) and grants (respectively denies) access to the protected group of data.

ST25TV02KC ST25TV512C

Data protection

(1)

Table 26. Security session type

Security session Open by presenting Rights granted when session is open

CONFIG PWD_CFG

AREA1 PWD_A1

AREA2 PWD_A2

UNTR PWD_UNTR Update of PWD_UNTR

Access to configuration registers

Update of PWD_CFG

Access to blocks from AREA1 in user memory

Update of PWD_A1

Access to blocks from AREA2 in user memory

Update of PWD_A2

Each of the PWD_CFG and PWD_UNTR passwords is 32-bit long.

In dual area mode (END_A1 < END_MEM), each of the PWD_A1 and PWD_A2 passwords is 32-bit long.

In single area mode (END_A1 = END_MEM), the PWD_A1 password is 64-bit long, and AREA2 security session is not applicable: password commands fail with password identifier 02h when single area mode is used.

Note: In addition to the security session mechanism described in this section, the PWD_CFG and PWD_UNTR

passwords are respectively used with the Kill and ToggleUntraceable commands.

Table 27. List of password registers

Password

PWD_CFG 00h 4 bytes

PWD_A1 01h

PWD_A2 02h

PWD_UNTR 03h 4 bytes

Password_id Password_data size

4 bytes if END_A1 < END_MEM

8 bytes if END_A1 = END_MEM

4 bytes if END_A1 < END_MEM

Invalid request if END_A1 = END_MEM

DS13304 - Rev 3

page 16/87

Page 17

ST25TV02KC ST25TV512C

Data protection

The ST25TVxxxC passwords management is based on three commands:

• WritePassword (see Section 6.4.18 WritePassword)

• PresentPassword (see Section 6.4.19 PresentPassword)

• GetRandomNumber (see Section 6.4.24 GetRandomNumber)

For any of the 4x passwords available, three actions are possible:

• Open Security Session:

– Use GetRandomNumber command if needed

– Use PresentPassword command with corresponding password identifier and valid encrypted password

value (see Section 5.1.4 User memory protection)

• Update Password:

– While the security session for the corresponding password is open, use WritePassword command with

same password identifier and the new encrypted password value (see Section 5.1.4 User memory

protection).

• Close Security Session:

– To close the security session corresponding to a password identifier, user can choose one of the

following options:

◦ Remove tag from RF field

◦ Use PresentPassword command with same password identifier and an invalid password value

◦ Open a security session corresponding to a different password identifier. Opening a new security

session automatically closes the previously opened one (even if the open operation fails)

Figure 6 describes the mechanism to open/close the security sessions.

DS13304 - Rev 3

page 17/87

Page 18

ST25TV02KC ST25TV512C

Figure 6. Security sessions management

ST25TVxxxC

out of RF field

Data protection

Present any

password not OK

Any other

command

Any other command

PWD_x OK

Any other command

Present

Field ON

All security

sessions

closed

PWD_x OK

Security

session x

opened

(y closed)

Security

session y

opened

(x closed)

Field OFF

Present

PWD_y OK

DS13304 - Rev 3

Password recovery

The ST25TVxxxC devices provide a password recovery feature, which allows the user to reprogram a corrupted password after a RF field failure during a WritePassword command.

Refer to “AN5577 - Password management for ST25TV512C and ST25TV02KC devices", for more details on how to use it. Contact your STMicroelectronics sales office to get this document.

Password attempt limit

The ST25TVxxxC devices offer the capability to protect a password against brute-force attacks, thanks to a limiter mechanism on failed password attempts.

Refer to “AN5577 - Password management for ST25TV512C and ST25TV02KC devices", for more details on how to use it. Contact your STMicroelectronics sales office to get this document.

page 18/87

Page 19

ST25TV02KC ST25TV512C

Data protection

5.1.3 Password encryption

An encryption mechanism - known as cover coding - is used to transmit coded password values in the Password_data field of the following command frames:

• PresentPassword request (see Section 6.4.19 PresentPassword),

• WritePassword request (see Section 6.4.18 WritePassword)

• Kill request (see Section 6.4.20 Kill)

• ToggleUntraceable request (see Section 6.4.23 ToggleUntraceable)

The mechanism requires that a call to the GetRandomNumber command has been issued since the latest boot of the ST25TVxxxC device, otherwise these password commands fail.

Additionally, if the latest call to a PresentPassword / Kill / ToggleUntraceable command failed because of an invalid value of the Password_data field, it is required that a call to the GetRandomNumber command is issued before attempting a new call to either of these three commands, otherwise their execution will fail regardless of the new value of the Password_data field.

Note: If the latest execution of a PresentPassword / ToggleUntraceable command was successful, it is not necessary

to issue a new call to the GetRandomNumber command before issuing a new PresentPassword / Kill / ToggleUntraceable request.

Assuming these constraints are fulfilled, let the RND_NUMBER_4B and RND_NUMBER_8B values be computed from the concatenation of the RND_NUMBER register value returned by the latest call to the GetRandomNumber request.

Table 28. RND_NUMBER_4B

b31-b16

RND_NUMBER RND_NUMBER

b15-b0

Table 29. RND_NUMBER_8B

b63-b48

RND_NUMBER RND_NUMBER RND_NUMBER RND_NUMBER

b47-b32 b31-b16 b15-b0

Let PASSWORD_4B (resp. PASSWORD_8B) be the unencrypted value of a 32-bit (resp. 64-bit) password to be transmitted over a PresentPassword / WritePassword / Kill / ToggleUntraceable request.

The Password_data field in a request frame shall be computed as follows :

• for a 32-bit password :

Password_data = XOR(RND_NUMBER_4B , PASSWORD_4B)

–

• for a 64-bit password :

Password_data = XOR(RND_NUMBER_8B , PASSWORD_8B)

–

Table 30. Example of 64-bit Password_data value computation

Data name

RND_NUMBER - - - - - - 1Dh E6h

RND_NUMBER_8B 1Dh E6h 1Dh E6h 1Dh E6h 1Dh E6h

PASSWORD_8B FAh D7h 5Eh 15h CAh A5h D0h D4h

Password_data E7h 31h 43h F3h D7h 43h CDh 32h

b63-b56 b55-b48 b47-b40 b39-b32 b31-b24 b23-b16 b15-b8 b7-b0

Note: A field coded on several bytes – such as Password_data – is transmitted in LSB to MSB byte order in ISO15693

request and response frames

DS13304 - Rev 3

page 19/87

Page 20

When processing a PresentPassword / Kill / ToggleUntraceable request, the ST25TVxxxC device decrypts the Password_data field to obtain the unencrypted value PASSWORD_4B (or PASSWORD_8B), which is used for comparison with the password register identified by the Password_id field.

When processing a WritePassword request, the ST25TVxxxC device decrypts the Password_data field to obtain the unencrypted value PASSWORD_4B (or PASSWORD_8B) , which is used for update of the password register identified by the Password_id field.

5.1.4 User memory protection

A read and/or write access protection can be globally applied to the blocks of an area. Such protection can be individually configured for AREA1 and AREA2, thanks to the RW_PROTECTION_A1 and RW_PROTECTION_A2 registers (see Table 11. RW_PROTECTION_A1 content and Table 15. RW_PROTECTION_A2 content).

On factory delivery, access to AREA1 and AREA2 are not protected. When updating RW_PROTECTION_Ax registers, the new protection mode is effective during the boot sequence of the next RF session.

In addition to the area protection mechanism, the write access to each block composing AREA1 and AREA2 can be individually locked thanks to the LockBlock command.

Block 00h is an exception to the area protection mechanism:

• when block 00h is not locked, the protection of its write access is determined by the value of RW_PROTECTION_A1 register, like other blocks of AREA1

• read access to block 00h is always allowed, regardless of the value of RW_PROTECTION_A1 register

The RW_PROTECTION_A1 register is locked when register LCK_A1 is set to 1b.

The RW_PROTECTION_A2 register is locked when register LCK_A2 is set to 1b.

The END_A1 register is locked when either of LCK_A1 and LCK_A2 registers is set to 1b.

ST25TV02KC ST25TV512C

Data protection

Retrieve the security status of a user memory block

User can read a block security status (BSS) by issuing following commands:

• GetMultipleBlockSecurityStatus

• ReadSingleBlock with Option_flag set to 1

• ReadMultipleBlocks with Option_flag set to 1

For each block, ST25TVxxxC will respond with a BSS byte containing a Lock_bit flag (b0 in Table 31) as specified in ISO 15693 standard.

Table 31. Block security status

b6 b5 b4 b3 b2 b1 b0

0: RFU

0: Write access to current block granted

1: Write access to current block denied

This Lock_bit flag is set to one if write access to the corresponding block is not allowed. This happens when either of the following conditions is met:

• the write access to the block was permanently locked (corresponding bit of LCK_BLOCK register set to 1b) by a successful LockBlock command

• write access to parent area is protected (RW_PROTECTION_Ax = 01b or 10b at start of the RF session) and security session is closed

• write access to parent area is forbidden (RW_PROTECTION_Ax = 11b at start of the RF session)

5.1.5 System configuration memory protection

Configurations registers listed Table 4. List of conﬁguration registers are accessed using the ReadConfiguration and WriteConfiguration commands.

Configuration registers are grouped by feature. A group is identified by parameter FID, a register from this group is identified by parameter PID.

Write access to configuration registers is protected or forbidden.

Note: Write access to read-only configuration registers is forbidden

DS13304 - Rev 3

page 20/87

Page 21

ST25TV02KC ST25TV512C

Unique tap code

Protected write access to a configuration register is granted when the CONFIG security session is open, and its parent group is not permanently locked.

Read access to configuration registers is protected or always allowed. Protected read access to a configuration register is granted when the CONFIG security session is open, and its parent group is not permanently locked.

On factory delivery, configuration groups are not locked (all bits of LCK_CONFIG register are set to 0b). A configuration group identified by FID (00h, 01h, 02h, 03h, 04h, 05h or 08h) can be permanently locked by setting bit FID of LCK_CONFIG register to 1b:

• if the read access to a configuration register from this group was protected, the register can no longer be read even if CONFIG security session is open

• if the write access to a configuration register from this group was protected, the register can no longer be written even if CONFIG security session is open

• write access to LCK_CONFIG register (FID=FFh, PID=00h) is granted when the CONFIG security session is open

• user cannot unlock a configuration group by setting bit FID of LCK_CONFIG back to 0b, even after opening CONFIG security session (Lock is permanent)

• user may lock several configuration groups with a single WriteConfiguration command by setting the respective bits of LCK_CONFIG to 1b in the request

System registers listed in Table 5. List of system registers include passwords, device identification registers, lock status and command status.

Read access to system registers is available except for passwords, AFI and DSFID lock status , Kill and ToggleUntraceable command status.

Device identification registers are detailed in section 5.10:

• Write access to AFI and DFSID registers can be respectively locked by LockAFI and LockDSFID commands. Lock is permanent: once locked, write access to AFI and DSFID registers is forbidden.

• Other device identification registers (IC_REF, UID) are read only registers.

5.2

Unique tap code

5.2.1 Unique tap code registers

Table 32. UTC_EN access

RF command Access type

ReadConﬁguration @(FID=02h, PID=00h) R : always possible

WriteConﬁguration @(FID=02h, PID=00h)

Bit Name Function Factory value

b0 UTC_EN

b7-b1 RFU - 0000000b

0: Unique tap code is disabled

1: Unique tap code is enabled

Note: Refer to Table 4. List of conﬁguration registers for the UTC_EN register.

W : if the CONFIG security session is open and LCK_UTC=0b

W effective time : on next RF boot sequence

Table 33. UTC_EN content

DS13304 - Rev 3

page 21/87

Page 22

Table 34. UTC access

RF command Access type

ReadConfiguration @(FID=02h, PID=01h) R : always possible

1. the content of the UTC register is updated internally during the RF boot sequence when UTC_EN is set to 1b

W : no write access

Table 35. UTC content

Bit Name Function Factory value

b23-b0 UTC Unique tap code value Not applicable

Note: Refer to Table 4. List of conﬁguration registers for the UTC register.

5.2.2 Unique tap code description

When the UTC_EN register is set to 1b, the content of the UTC register is updated internally with a fresh value during each RF boot sequence. The content of the UTC register is coded in ASCII format.

The UTC_EN register is locked when register LCK_UTC is set to 1b.

Note: When the Unique tap code is enabled, the duration of the RF boot sequence t

• compliant with the 5ms guard-time value deﬁned in the NFC Forum [DIGITAL] speciﬁcation

• not compliant with the 1ms guard-time value deﬁned in the ISO15693 speciﬁcation

Refer to “AN5578 - Unique tap code for ST25TV512C and ST25TV02KC devices", for more details on the content of the UTC register. Contact your STMicroelectronics sales office to get this document.

ST25TV02KC ST25TV512C

Tamper detection

(1)

(see section 8.2) is:

Boot_RF

5.3 Tamper detection

The tamper detection feature is available on ST25TV02KC-T devices only (see section 10). On ST25TVxxxC-A devices, ReadConﬁguration and WriteConﬁguration commands requested with FID=03h fail with error code 10h.

5.3.1 Tamper detection registers

Table 36. TD_EVENT_UPDATE_EN access

RF command Access type

ReadConﬁguration @(FID=03h, PID=00h) R : always possible

WriteConﬁguration @(FID=03h, PID=00h)

Table 37. TD_EVENT_UPDATE_EN content

Bit Name Function Factory value

b0 TD_EVENT_UPDATE_EN

b7- b1 RFU - 0000000b

Note: Refer to Table 4. List of conﬁguration registers for the TD_EVENT_UPDATE_EN register.

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : on next RF boot sequence

0: memorization of tamper events disabled

1: memorization of tamper events enabled

DS13304 - Rev 3

page 22/87

Page 23

ST25TV02KC ST25TV512C

Tamper detection

Table 38. TD_SEAL_MSG access

RF command Access type

ReadConﬁguration @(FID=03h, PID=01h) R : if the CONFIG security session is open and LCK_TD=0b

WriteConﬁguration @(FID=03h, PID=01h)

Table 39. TD_SEAL_MSG content

Bit Name Function Factory value

b15-b0 TD_SEAL_MSG Value of TD_EVENT displayed before first occurence of a TD_UNSEAL event 3030h

Note: Refer to Table 4. List of conﬁguration registers for the TD_SEAL_MSG register.

Table 40. TD_UNSEAL_MSG access

RF command Access type

ReadConﬁguration @(FID=03h, PID=02h) R : if the CONFIG security session is open and LCK_TD=0b

WriteConﬁguration @(FID=03h, PID=02h)

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : immediate

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : immediate

Table 41. TD_UNSEAL_MSG content

Bit

b15-b0 TD_UNSEAL_MSG Value of TD_EVENT displayed after first occurrence of a TD_UNSEAL event 5555h

Name Function Factory value

Note: Note: Refer to Table 4. List of conﬁguration registers for the TD_UNSEAL_MSG register.

Table 42. TD_RESEAL_MSG access

RF command

ReadConﬁguration @(FID=03h, PID=03h) R : if the CONFIG security session is open and LCK_TD=0b

WriteConﬁguration @(FID=03h, PID=03h)

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : immediate

Access type

Table 43. TD_RESEAL_MSG content

Bit

b15-b0 TD_RESEAL_MSG Value of TD_EVENT displayed after occurrence of a TD_RESEAL event 5252h

Name Function Factory value

Note: Note: Refer to Table 4. List of conﬁguration registers for the TD_RESEAL_MSG register.

Table 44. TD_SHORT_MSG access

DS13304 - Rev 3

RF command

ReadConﬁguration @(FID=03h, PID=04h) R : if the CONFIG security session is open and LCK_TD=0b

WriteConﬁguration @(FID=03h, PID=04h)

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : immediate

Access type

page 23/87

Page 24

ST25TV02KC ST25TV512C

Table 45. TD_SHORT_MSG content

Bit Name Function Factory value

b7- b0 TD_SHORT_MSG

Note: Note: Refer to Table 4. List of conﬁguration registers for the TD_SHORT_MSG register.

RF command Access type

ReadConﬁguration @(FID=03h, PID=05h) R : if the CONFIG security session is open and LCK_TD=0b

WriteConﬁguration @(FID=03h, PID=05h)

Bit Name Function Factory value

b7- b0 TD_OPEN_MSG

Message displayed when the tamper loop was in closed status during the latest boot sequence

Table 46. TD_OPEN_MSG access

W : if the CONFIG security session is open and LCK_TD=0b

W effective time : immediate

Table 47. TD_OPEN_MSG content

Message displayed when the tamper loop was in open status during the latest boot sequence

Tamper detection

63h

6Fh

Note: Refer to Table 4. List of conﬁguration registers for the TD_OPEN_MSG register.

Table 48. TD_STATUS access

RF command

ReadConﬁguration @(FID=03h, PID=06h) R : always possible

- W : no write access

Table 49. TD_STATUS content

Bit

b15-b0 TD_EVENT

b23-b16 TD_LOOP

Name Function Factory value

TD_SEAL_MSG, TD_UNSEAL_MSG or TD_RESEAL_MSG

according to result of tamper event detection

TD_SHORT_MSG or TD_OPEN_MSG

according to the status of the tamper loop during the latest boot sequence

Note: Refer to Table 5. List of system registers for the TD_STATUS register.

5.3.2 Tamper detection description

The tamper detection feature allows to check the shortage status between the TD0 and TD1 pins of the ST25TV02KC-T, and monitor tamper events.

See Section 8.2 RF electrical parameters for recommended impedance values Ropen and Rclosed in cases of open and closed tamper loop.

The shortage status TD_LOOP and event status TD_EVENT are read in the response to a ReadConﬁguration request with FID=03h and PID=06h.

This is the customer responsibility to check the values of TD_LOOP and TD_EVENT and behave accordingly.

Access type

Not applicable

DS13304 - Rev 3

page 24/87

Page 25

ST25TV02KC ST25TV512C

Augmented NDEF

TD_LOOP

The shortage status TD_LOOP is captured by ST25TV02KC-T each time that the device is powered- up. Value of TD_LOOP is equal to value of:

• TD_SHORT_MSG when TD0 and TD1 were connected at capture time

• TD_OPEN_MSG when TD0 and TD1 were not connected at capture time

This information will be lost during power off (no permanent storage of TD_LOOP).

TD_EVENT

The TD_EVENT status is used to monitor the ﬁrst occurrences of TD_UNSEAL and TD_RESEAL events deﬁned as follows:

• TD_UNSEAL: TD_EVENT_UPDATE_EN register was set to 1b, and TD0 and TD1 were not connected at capture time

• TD_RESEAL: TD_EVENT_UPDATE_EN register was set to 1b, TD_UNSEAL already occurred, and TD0 and TD1 were connected at capture time

On factory delivery, TD_EVENT_UPDATE_EN is set to 0b and TD_EVENT is set to the value of TD_SEAL_MSG.

When the first TD_UNSEAL event occurs, TD_EVENT is updated to the value of TD_UNSEAL_MSG.

When the first TD_RESEAL event occurs, TD_EVENT is updated to the value of TD_RESEAL_MSG.

The update of the TD_EVENT register occurs during the RF boot sequence, and its value is stored in the EEPROM of the ST25TV02KC-T device.

When the LCK_TD register is set to 1b, the TD_EVENT_UPDATE_EN, TD_SEAL_MSG, TD_UNSEAL_MSG, TD_RESEAL_MSG, TD_SHORT_MSG and TD_OPEN_MSG registers are locked.

Note: When TD_EVENT is updated, the duration of the RF boot sequence t

parameters) is:

• compliant with the 5ms guard-time value deﬁned in the NFC Forum [DIGITAL] speciﬁcation

• not compliant with the 1ms guard-time value deﬁned in the ISO15693 speciﬁcation

Note: When TD_EVENT_UPDATE_EN and UTC_EN registers are set to 0b, no programmation of the EEPROM

occurs during the RF boot sequence, and its duration is compliant with the 1ms guard-time value deﬁned in the ISO15693 speciﬁcation.

Note: Tamper detection events occurring outside of the capture window (for instance while the IC is in POWER-OFF

state, or during the RF session following the boot sequence) are not detected by the ST25TV02KC-T.

(see Section 8.2 RF electrical

Boot_RF

5.4

Augmented NDEF

5.4.1 Augmented NDEF registers

RF command Access type

ReadConﬁguration @(FID=04h, PID=00h) R : always possible

WriteConﬁguration @(FID=04h, PID=00h)

DS13304 - Rev 3

Table 50. ANDEF_EN access

W : if the CONFIG security session is open and LCK_ANDEF=0b

W effective time : on next RF boot sequence

page 25/87

Page 26

Table 51. ANDEF_EN content

Bit Name Function Factory value

b0 ANDEF_EN

0: ANDEF feature is disabled,

1: ANDEF feature is enabled

b7- b1 RFU - 0000000b

Note: Refer to Table 4. List of conﬁguration registers for the ANDEF_EN register.

Table 52. ANDEF_CFG access

RF command Access type

ReadConﬁguration @(FID=04h, PID=01h) R : always possible

WriteConﬁguration @(FID=04h, PID=01h)

W : if the CONFIG security session is open and LCK_ANDEF=0b

W effective time : on next RF boot sequence

Table 53. ANDEF_CFG content

ST25TV02KC ST25TV512C

Augmented NDEF

Bit Name Function Factory value

b0 ANDEF_UID_EN

b1 ANDEF_CUS_EN

b2 ANDEF_UTC_EN

0: UID ﬁeld disabled in ANDEF feature

1: UID ﬁeld enabled in ANDEF feature

0: Custom ﬁeld disabled in ANDEF feature

1: Custom ﬁeld enabled in ANDEF feature

0: Unique tap code ﬁeld disabled in ANDEF feature

1: Unique tap code ﬁeld enabled in ANDEF feature

b3 RFU - 0b

0: Tamper detection ﬁeld disabled in ANDEF feature

ANDEF_TD_EN

b5 ANDEF_SEP_EN

(1)

1: Tamper detection ﬁeld enabled in ANDEF feature

0: ANDEF ﬁeld separator disabled

1: ANDEF ﬁeld separator enabled

b7- b6 ANDEF_BYTE Byte offset in block ANDEF_BLOCK where the ANDEF feature starts operating 00b

b15-b8 ANDEF_BLOCK Block address where the ANDEF feature starts operating 00h

1. relevant on ST25TV02KC-T devices only, forced to 0b on ST25TVxxxC-A devices

Note: Refer to Table 4. List of conﬁguration registers for the ANDEF_CFG register.

Table 54. ANDEF_SEP access

DS13304 - Rev 3

RF command

Access type

ReadConﬁguration @(FID=04h, PID=02h) R : if the CONFIG security session is open and LCK_ANDEF=0b

WriteConﬁguration @(FID=04h, PID=02h)

W : if the CONFIG security session is open and LCK_ANDEF=0b

W effective time : immediate

Table 55. ANDEF_SEP content

Bit

b7- b0 ANDEF_SEP Character used as ANDEF ﬁeld separator when ANDEF_SEP_EN=1b 78h

Name Function Factory value

page 26/87

Page 27

ST25TV02KC ST25TV512C

Note: Refer to Table 4. List of conﬁguration registers for the ANDEF_SEP register.

Table 56. ANDEF_CUSTOM_LSB access

RF command Access type

ReadConﬁguration @(FID=04h, PID=03h) R : if the CONFIG security session is open and LCK_ANDEF=0b

WriteConﬁguration @(FID=04h, PID=03h)

Table 57. ANDEF_CUSTOM_LSB content

Bit Name Function Factory value

b31-b0 ANDEF_CUSTOM_LSB First 4 characters of the ANDEF custom ﬁeld 2E2E2E2Eh

Note: Refer to Table 4. List of conﬁguration registers for the ANDEF_CUSTOM_LSB register.

Table 58. ANDEF_CUSTOM_MSB access

W : if the CONFIG security session is open and LCK_ANDEF=0b

W effective time : immediate

Augmented NDEF

RF command Access type

ReadConﬁguration @(FID=04h, PID=04h) R : if the CONFIG security session is open and LCK_ANDEF=0b

WriteConﬁguration @(FID=04h, PID=04h)

W : if the CONFIG security session is open and LCK_ANDEF=0b

W effective time : immediate

Table 59. ANDEF_CUSTOM_MSB content

Bit

b31-b0 ANDEF_CUSTOM_MSB Last 4 characters of the ANDEF custom ﬁeld 2E2E2E2Eh

Name Function Factory value

Note: Refer to Table 4. List of conﬁguration registers for the ANDEF_CUSTOM_MSB register.

Table 60. ANDEF_UID access

RF command

ReadSingleBlock

ReadMultipleBlocks

- W : no write access

R : if ANDEF_EN=1b and ANDEF_UID_EN=1b

Access type

Table 61. ANDEF_UID content

Bit

b127-b0 ANDEF_UID Value displayed in the UID ﬁeld of the ANDEF feature UID in ASCII format starting with "E0"

Name Function Factory value

Note: Refer to Table 5. List of system registers for the ANDEF_UID register.

DS13304 - Rev 3

page 27/87

Page 28

ST25TV02KC ST25TV512C

Augmented NDEF

5.4.2 Augmented NDEF description

The Augmented NDEF feature (ANDEF) is a contextual automatic NDEF message service, allowing the tag to respond dynamic content without an explicit update of the EEPROM by the end user.

The feature is enabled (resp. disabled) when the value of register ANDEF_EN is 1b (resp. 0b) during the latest RF boot sequence. When the feature is enabled, user memory data at byte addresses ranging from ANDEF_START to ANDEF_END is replaced by the content of a virtual memory ANDEF_MEM in the response to ReadSingleBlock and ReadMultipleBlocks requests.

Note: The BSS values responded to ReadSingleBlock and ReadMultipleBlocks requests are not modiﬁed when the

ANDEF feature is enabled

Note: The ANDEF feature has no effect on the WriteSingleBlock command. When the feature is enabled, and a

WriteSingleBlock command is issued on a block crossing the [ANDEF_START:ANDEF_END] range, the data from the command is directly written to user memory, without replacement by volatile memory content.

Table 62. Block data read when ANDEF feature is disabled on ST25TV02KC

Block address

Block data

Byte0 Byte1 Byte2 Byte3

00h

UM000 UM001 UM002 UM003

... ... ... ... ... No bytes read from ANDEF_MEM memory

(3)

4Fh

UM316 UM317 UM318 UM319

1. Block data responded to ReadSingleBlock and ReadMultipleBlocks requests.

2. UM stands for user memory.

3. ST25TV02KC memory size is used in this example. Note that last block address is 0Fh on ST25TV512C devices.

(1)

Comment

First block of UM

Last block of UM

(2)

Table 63. Block data read when ANDEF feature is enabled on ST25TV02KC

Block address

Block data

Byte0 Byte1 Byte2 Byte3

00h

UM000 UM001 UM002 UM003

... ... ... ... ... -

2Dh UM180 UM181 UM182 UM183

2Eh UM184 AM000 AM001 AM002

2Fh AM003 AM004 AM005 UM191

30h UM192 UM193 UM194 UM195

... ... ... ... ... -

(4)

4Fh

UM316 UM317 UM318 UM319

1. Block data responded to ReadSingleBlock and ReadMultipleBlocks requests.

2. UM stands for user memory

3. AM stands for ANDEF_MEM memory

4. ST25TV02KC memory size is used in this example. Note that last block address is 0Fh on ST25TV512C devices.

(1)

Comment

First block of UM

(2)

Example with

ANDEF_START=185 and

ANDEF_END=190

(6 bytes of UM

Last block of UM

(2)

replaced with AM

(2)

(3)

)

Byte addresses ANDEF_START and ANDEF_END depend on the value of register ANDEF_CFG during the latest RF boot sequence:

ANDEF_START = ANDEF_BLOCK * 4 + ANDEF_BYTE

•

• ANDEF_END = min(END_MEM * 4 + 3, ANDEF_START + ANDEF_LEN - 1)

DS13304 - Rev 3

Where ANDEF_LEN is the number of bytes available from ANDEF_MEM memory:

• ANDEF_LEN = ANDEF_UID_EN * 16 + ANDEF_CUS_EN * 8 + ANDEF_UTC_EN * 3 + ANDEF_TD_EN * 3

+ ANDEF_SEP_EN*(ANDEF_UID_EN + ANDEF_CUS_EN + ANDEF_UTC_EN + ANDEF_TD_EN - 1)

page 28/87

Page 29

ST25TV02KC ST25TV512C

Augmented NDEF

Content of ANDEF_MEM depends on the values of ANDEF_CFG, ANDEF_UID, ANDEF_CUSTOM_LSB, ANDEF_CUSTOM_MSB, UTC, TD_STATUS and ANDEF_SEP registers.

The content of ANDEF_MEM is the result of the concatenation of ANDEF ﬁelds. Each ﬁeld corresponds to a conﬁguration register. The order of appearance, content and condition of presence of each ﬁeld is listed in the table below.

Table 64. ANDEF ﬁelds concatenated in ANDEF_MEM

Order

1 ANDEF_UID 16 ANDEF_UID_EN=1b

2 ANDEF_SEP 1 ANDEF_UID_EN=1b and ANDEF_CUS_EN=1b and ANDEF_SEP_EN=1b

3 ANDEF_CUSTOM_LSB 4 ANDEF_CUS_EN=1b

4 ANDEF_CUSTOM_MSB 4 ANDEF_CUS_EN=1b

5 ANDEF_SEP 1

6 UTC 3 ANDEF_UTC_EN=1b

7 ANDEF_SEP 1

8 TD_STATUS 3

1. When a register value is coded on several bytes, it is copied in LSB to MSB byte order in the ANDEF_MEM memory.

2. TD_STATUS ﬁeld available on ST25TV02KC-T devices only

Content

(1)

Bytes Condition of presence

(ANDEF_UID_EN=1b or ANDEF_CUS_EN=1b)

and ANDEF_UTC_EN=1b and ANDEF_SEP_EN=1b

(ANDEF_UID_EN=1b or ANDEF_CUS_EN=1b or ANDEF_UTC_EN=1b)

and ANDEF_TD_EN=1b

ANDEF_TD_EN=1b

(2)

and ANDEF_SEP_EN=1b

(2)

As an example, Figure 7 shows the usage of the ANDEF feature to display the value of the ANDEF_UID and TD_STATUS registers in a NDEF URI message : the content of the NDEF message may change after a tamper detection event without modiﬁcation of the user memory content.

Figure 7. Example of augmented NDEF message on ST25TV02KC-T

DS13304 - Rev 3

On factory delivery, ANDEF_EN register is set to 0b and ANDEF_CFG register is set to 0020h.

page 29/87

Page 30

When the LCK_ANDEF register is set to 1b, ANDEF_EN, ANDEF_CFG, ANDEF_SEP, ANDEF_ CUSTOM_LSB and ANDEF_CUSTOM_MSB registers are locked.

5.5 Consumer privacy protection

The Kill and Untraceable features offer consumer privacy capabilities required by the GDPR.

5.5.1 Privacy registers

RF command Access type

- R : no read access

Kill

W : if Kill command responds with Error_ﬂag=0b

W effective time : immediate

ST25TV02KC ST25TV512C

Consumer privacy protection

Table 65. KILL_CMD access

Table 66. KILL_CMD content

Bit Name Function Factory value

b0 KILL_CMD

0: successful Kill command did not occur

1: successful Kill command did occur

Note: Refer to Table 5. List of system registers for the KILL_CMD register.

Table 67. UNTR_CMD access

RF command Access type

- R : no read access

ToggleUntraceable

W : if ToggleUntraceable command responds with Error_ﬂag=0b

W effective time : immediate

Table 68. UNTR_CMD content

Bit

b0 UNTR_CMD

Name Function Factory value

0: last successful ToggleUntraceable command occured with Address_ﬂag=0b

1: last successful ToggleUntraceable command occured with Address_ﬂag=1b

Note: Refer to Table 5. List of system registers for the UNTR_CMD register.

DS13304 - Rev 3

Table 69. PRIVACY access

RF command

ReadConﬁguration @(FID=05h, PID=00h) R : always possible

WriteConﬁguration @(FID=05h, PID=00h)

W : if the CONFIG security session is open and LCK_PRIV=0b

W effective time : on next RF boot sequence

Access type

page 30/87

Page 31

Table 70. PRIVACY content

ST25TV02KC ST25TV512C

Consumer privacy protection

Bit Name Function

00: device boots in UNTRACEABLE state when UNTR_CMD=1b

01: device always boots in UNTRACEABLE state

b1- b0 UNTR_DFT

b2 DIS_INV

b3 DIS_KILL

b7- b4 RFU - 0000b

10: device boots in UNTRACEABLE state when UNTR_CMD=1b or tamper loop is closed

11: device boots in UNTRACEABLE state when UNTR_CMD=1b or tamper loop is open

0: Inventory command responds in UNTRACEABLE state

1: Inventory command is mute in UNTRACEABLE state

0: Kill command is enabled

1: Kill command is disabled

Note: Refer to Table 4. List of conﬁguration registers for the PRIVACY register.

5.5.2 Kill feature description

When the ST25TVxxxC is in KILLED state, all incoming RF requests are ignored.

The ST25TVxxxC enters the KILLED state on a successful Kill command (see Section 6.4.20 Kill), which sets the KILL_CMD register to 1b. Once the ST25TVxxxC has entered the KILLED state, it can only switch between the POWER-OFF and KILLED states (see Section 6.2.8 ISO15693 states).

The Kill command is enabled/disabled when the DIS_KILL register respectively has value 0/1b during the latest boot sequence. The update of the DIS_KILL register is effective on the next RF boot sequence.

While the Kill command is disabled, the Kill request is ignored and the ST25TVxxxC can not enter the KILLED state.

On factory delivery, the KILL_CMD and DIS_KILL registers are set to 0b.

When the LCK_PRIV register is set to 1b, the DIS_KILL register is locked.

Factory

value

00b

5.5.3 Untraceable feature description

When the ST25TVxxxC is in UNTRACEABLE state, all incoming RF requests are ignored except:

• GetRandomNumber and ToggleUntraceable requests (see Section 6.4.23 ToggleUntraceable and

Section 6.4.24 GetRandomNumber)

• Inventory and ReadSingleBlock (block 00h only) requests if value of DIS_INV register was 0b during the latest RF boot sequence

The ST25TVxxxC enters the UNTRACEABLE state on a successful ToggleUntraceable command requested with Address_ﬂag=1b, which sets the UNTR_CMD register to 1b.

The ST25TVxxxC leaves the UNTRACEABLE state on a successful ToggleUntraceable command requested with Address_ﬂag=0b, which sets the UNTR_CMD register to 0b.

After a RF boot sequence, the ST25TVxxxC enters the UNTRACEABLE state if KILL_CMD register is set to 0b and either of the following conditions is met:

• value of UNTR_CMD register is 1b

• value of UNTR_DFT register is 01b

• value of UNTR_DFT register is 10b and tamper loop is closed (ST25TV02KC-T devices only)

• value of UNTR_DFT register is 11b and tamper loop is open (ST25TV02KC-T devices only)

See Section 6.2.8 ISO15693 states for further details.

Note: After a RF boot sequence with KILL_CMD=UNTR_CMD=0b and UNTR_DFT=10b :

• the ST25TV02KC-T enters the UNTRACEABLE state if the tamper loop is closed

• the ST25TV02KC-T enters the READY state if the tamper loop is open

DS13304 - Rev 3

page 31/87

Page 32

ST25TV02KC ST25TV512C

TruST25 digital signature

Note: After a RF boot sequence with KILL_CMD=UNTR_CMD=0b and UNTR_DFT=11b:

• the ST25TV02KC-T enters the UNTRACEABLE state if the tamper loop is open

• the ST25TV02KC-T enters the READY state if the tamper loop is closed

Note: On ST25TVxxxC-A devices, 10b and 11b values of UNTR_DFT register are interpreted as value 00b.

Untraceability of the customer is claimed for the following reasons :

• in a NFC Forum application, block 00h contains the CC ﬁle which does not allow to identify a customer

• user blocks 01h to END_MEM - which contain customer data - can not be accessed in UNTRACEABLE state

• while in UNTRACEABLE state, the UID value used in request and response frames of Inventory and ReadSingleBlock commands is ﬁxed (see Section 7.1 Untraceable UID) and does not allow to identify a customer

Furthermore, the user may conﬁgure the ST25TVxxxC to ignore Inventory and ReadSingleBlock requests in UNTRACEABLE state, by setting the DIS_INV register to 1b.

The update of the DIS_INV and UNTR_DFT registers is effective on the next RF boot sequence. On factory delivery, the DIS_INV and UNTR_DFT registers are set to 0.

When the LCK_PRIV register is set to 1b, the UNTR_DFT and DIS_INV registers are locked.

5.6 TruST25 digital signature

The ST25TVxxxC devices support the TruST25 digital signature feature, which allows the user to verify the authenticity of the device, thanks to a unique digital signature.

TruST25 solution encompasses secure industrialization processes and tools deployed by STMicroelectronics to generate, store and check the signature in the device.

Refer to “AN5580 - TruST25 digital signature for ST25TV512C and ST25TV02KC devices", for more details on how to use it. Contact your STMicroelectronics sales office to get this document.

5.7

AFI protection

5.7.1 AFI protection registers

Table 71. AFI_PROT access

RF command Access type

ReadConﬁguration @(FID=08h, PID=00h) R : always possible

WriteConﬁguration @(FID=08h, PID=00h)

Bit Name Function Factory value

b0 AFI_PROT

b7- b1 RFU - 0000000b

0: WriteAFI and LockAFI commands do not depend from AREA1 security session

1: WriteAFI and LockAFI commands fail when AREA1 security session is closed

Note: Refer to Table 4. List of conﬁguration registers for the AFI_PROT register.

W : if the CONFIG security session is open and LCK_AFIP=0b

W effective time : on next RF boot sequence

Table 72. AFI_PROT content

DS13304 - Rev 3

page 32/87

Page 33

5.7.2 AFI protection description

This feature allows to protect the WriteAFI and LockAFI commands with the AREA1 security session, and is conﬁgured by register AFI_PROT.

On factory delivery, the AFI_PROT register is set to 0b. When AFI_PROT register is set to 0b:

• the WriteAFI command is successful if the LCK_AFI register is set to 0b, and fails otherwise

• the LockAFI command is successful if the LCK_AFI register is set to 0b, and fails otherwise

When AFI_PROT register is set to 1b:

• the WriteAFI command is successful if AREA1 security session is open and the LCK_AFI register is set to 0b, and fails otherwise

• the LockAFI command is successful if AREA1 security session is open and the LCK_AFI register is set to 0b, and fails otherwise

When the LCK_AFIP register is set to 1b, the AFI_PROT register is locked.

5.8 Inventory Initiated

ST25TVxxxC provides a special feature to improve the anticollision sequence on moving tags using the Initiate_ﬂag volatile register. This register, controlled by the Initiate command (refer to Section 6.4.21 Initiate), allows ST25TVxxxC to respond to InventoryInitiated requests (refer to Section 6.4.22 InventoryInitiated).

For applications where multiple tags are crossing the RF ﬁeld of a reader, it is possible to miss tags when the standard Inventory command is used. The reason is that the anticollision sequence performs a global tree search, calling the command at each node and leaf of the tree. In a worst case, a tag WC waits a long delay before it is inventoried as a leaf of the search. Such delay can be furthermore increased by tags entering the RF ﬁeld of the reader during the search, and tag WC may have left the ﬁeld before being inventoried.

This usecase can be improved by replacing the standard Inventory command with the custom InventoryInitiated command in the anticollision sequence. When multiple tags are crossing the RF ﬁeld of the reader, the anticollision sequence is started by an Initiate command which initiates the set of tags within range. InventoryInitiated requests are ignored by tags entering the RF ﬁeld after the Initiate command, they are only processed by the set of initiated tags, hence bounding the time necessary to complete the anticollision sequence. When an initiated tag is inventoried, it is sent to QUIET state to ignore further InventoryInitiated requests.

Once an anticollision sequence is completed, the reader starts a new sequence that will operate only on tags which have entered the RF ﬁeld during the previous sequence, and so on.

ST25TV02KC ST25TV512C

Inventory Initiated

5.9 Device identiﬁcation registers

Registers described in this section are located in System conﬁguration memory. Refer to section 4.3 for more details.

Table 73. LCK_DSFID access

RF command Access type

- R : no read access

LockDSFID

Bit Name Function Factory value

b0 LCK_DSFID

0: successful LockDSFID command did not occur

1: successful LockDSFID command did occur

Note: Refer to Table 5. List of system registers for the LCK_DSFID register.

W : if LCK_DSFID=0b

W effective time : immediate

Table 74. LCK_DSFID content

DS13304 - Rev 3

page 33/87

Page 34

Table 75. LCK_AFI access

RF command Access type

- R : no read access

LockAFI

W : if LCK_AFI=0b and (AFI_PROT=0b or AREA1 security session is open)

W effective time : immediate

Table 76. LCK_AFI content

Bit Name Function Factory value

b0 LCK_AFI

0: successful LockAFI command did not occur

1: successful LockAFI command did occur

Note: Refer to Table 5. List of system registers for the LCK_AFI register.

Table 77. DSFID access

RF command Access type

Inventory R : always possible

GetSystemInfo R : always possible

ExtendedGetSystemInfo R : always possible

Initiate R : always possible

InventoryInitiated R : always possible

WriteDSFID

W : if LCK_DSFID=0b

W effective time : immediate

ST25TV02KC ST25TV512C

Device identiﬁcation registers

Table 78. DSFID content

Bit

b7-b0 DSFID ISO/IEC 15693 Data Storage Format IDentiﬁer 00h

Name Function Factory value

Note: Refer to Table 5. List of system registers for the DSFID register.

Table 79. AFI access

RF command

GetSystemInfo R : always possible

ExtendedGetSystemInfo R : always possible

WriteAFI

W : if LCK_AFI=0b and (AFI_PROT=0b or AREA1 security session is open)

W effective time : immediate

Table 80. AFI content

Bit

b7-b0 AFI ISO/IEC 15693 Application Family Identiﬁer 00h

Name Function Factory value

Note: Refer to Table 5. List of system registers for the AFI register.

Access type

DS13304 - Rev 3

page 34/87

Page 35

Table 81. IC_REF access

RF command Access type

GetSystemInfo R : always possible

ExtendedGetSystemInfo R : always possible

- W : no access

Table 82. IC_REF content

Bit Name Function Factory value

b7-b0 IC_REF ISO/IEC 15693 IC reference 08h

Note: Refer to Table 5. List of system registers for the IC_REF register.

Table 83. REV access

RF command Access type

ReadConﬁguration @(FID=FEh, PID=00h) R : always possible

- W : no access

ST25TV02KC ST25TV512C

Device identiﬁcation registers

Table 84. REV content

Bit

b7-b0 REV IC revision number 00h

Name Function Factory value

Note: Refer to Table 4. List of conﬁguration registers for the REV register.

Table 85. UID access

RF command

Inventory R : always possible

GetSystemInfo R : always possible

ExtendedGetSystemInfo R : always possible

Initiate R : always possible

InventoryInitiated R : always possible

ReadConﬁguration @(FID=FEh, PID=01h) R : always possible

- W : no access

Access type

DS13304 - Rev 3

page 35/87

Page 36

Table 86. UID content

Bit Name Function Factory value

b7-b0

b15-b8 ISO/IEC 15693 UID byte 1

b23-b16 ISO/IEC 15693 UID byte 2

b31-b24 ISO/IEC 15693 UID byte 3

b39-b32 ISO/IEC 15693 UID byte 4

b47-b40 ISO/IEC 15693 UID byte 5 08h

b55-b48 ISO/IEC 15693 UID byte 6 02h

b63-b56 ISO/IEC 15693 UID byte 7 E0h

UID

ISO/IEC 15693 UID byte 0

Note: Refer to Table 5. List of system registers for the UID register.

ST25TV02KC ST25TV512C

Device identiﬁcation registers

IC manufacturer serial number

DS13304 - Rev 3

page 36/87

Page 37

6 RF Operation

The device follows ISO/IEC 15693 and NFC Forum Type 5 Tag specification for radio- frequency power and signal interface and for anticollision and transmission protocol.

The device communicates via the 13.56 MHz carrier electromagnetic wave on which incoming data are demodulated from the received signal amplitude modulation (ASK: amplitude shift keying). The received ASK wave is 10% or 100% modulated with a data rate of 1.6 Kbit/s using the 1/256 pulse coding mode or a data rate of 26 Kbit/s using the 1/4 pulse coding mode.

Outgoing data are generated by the ST25TVxxxC load variation using Manchester coding with one or two subcarrier frequencies at 423 kHz and 484 kHz. Data are transferred from the ST25TVxxxC at 6.6 Kbit/s in low data rate mode and 26 Kbit/s in high data rate mode.

6.1 RF communication

6.1.1 Access to a ISO/IEC 15693 device

The dialog between the reader and the ST25TVxxxC takes place as follows:

• activation of the ST25TVxxxC by the operating ﬁeld of the reader

• transmission of a command by the reader (ST25TVxxxC detects carrier amplitude modulation)

• transmission of a response by the ST25TVxxxC using load modulation.

These operations use the power transfer and communication signal interface described below. This technique is called RTF (reader talk ﬁrst).

ST25TV02KC ST25TV512C

RF Operation

Operating ﬁeld

The ST25TVxxxC operates continuously between the minimum and maximum values of the electromagnetic ﬁeld H deﬁned in Table 172. RF characteristics. The reader has to generate a ﬁeld within these limits.

Power transfer

Power is transferred to the ST25TVxxxC by radio frequency at 13.56 MHz via coupling antennas in the ST25TVxxxC and the reader. The operating ﬁeld of the reader is transformed on the ST25TVxxxC antenna to an AC voltage that is rectiﬁed, ﬁltered and internally regulated. During communications, the amplitude modulation (ASK) on this received signal is demodulated by the ASK demodulator.

Frequency

The ISO 15693 standard deﬁnes the carrier frequency (fC) of the operating ﬁeld as 13.56 MHz ± 7 kHz.

Note: In this document, fC symbol is used for the nominal value of fCC (fC=13.56 MHz).

6.2

RF protocol

6.2.1 Protocol description

The transmission protocol (or simply “the protocol”) deﬁnes the mechanism used to exchange instructions and data between the VCD (vicinity coupling device) and the VICC (vicinity integrated circuit card) in both directions. It is based on the concept of “VCD talks ﬁrst”. The device acts as the VICC.

This means that a ST25TVxxxC does not start transmitting unless it has received and properly decoded an instruction sent by the VCD. The protocol is based on an exchange of commands, which consist in request/ response transactions between the VCD and the ST25TVxxxC:

• a request is sent from the VCD to the ST25TVxxxC

• a response to this request is sent from the ST25TVxxxC to the VCD.

Each request and each response are contained in a frame. The frames are delimited by a Start of Frame (SOF) and End of Frame (EOF).

DS13304 - Rev 3

page 37/87

Page 38

ST25TV02KC ST25TV512C

RF protocol

The protocol is bit-oriented. The number of bits transmitted in a frame is a multiple of eight (8), that is an integer number of bytes.

A single-byte ﬁeld is transmitted least signiﬁcant bit (LSBit) ﬁrst. A multiple-byte ﬁeld is transmitted least signiﬁcant byte (LSByte) ﬁrst and each byte is transmitted least signiﬁcant bit (LSBit) ﬁrst.

Figure 8. ISO15693 protocol timing

VCD

ST25TVxxxC

Timing

6.2.2 Request format

A request frame consists in :

• a SOF

• request flags

• a command code

• request parameters and data

• a CRC

• an EOF.

Request

frame

Request

frame

Response

frame

Table 87. General request format

Response

frame

SOF Request_ﬂags Opcode Parameters Data CRC_B EOF

- 8 bits 8 bits optional optional 16 bits -

6.2.3 Request ﬂags

In a request frame, the Request_ﬂags ﬁeld speciﬁes the actions to be performed by the ST25TVxxxC and whether corresponding ﬁelds are present or not.

The Request_ﬂags ﬁeld consists of eight bits indexed from 0 to 7.

Note: Indexing of bits starts from 0 to comply with the convention used in this speciﬁcation, however note that indexing

of these bits starts at 1 in the ISO/IEC 15693 speciﬁcation.

Bit 2 (Inventory_ﬂag) of Request_ﬂags deﬁnes the contents of the four MSBs (bits 4 to 7).

When Inventory_ﬂag value is 0, bits 4 to 7 deﬁne the ST25TVxxxC selection criteria.

When Inventory_ﬂag value is 1, bits 4 to 7 deﬁne the ST25TVxxxC Inventory parameters.

DS13304 - Rev 3

page 38/87

Page 39

ST25TV02KC ST25TV512C

RF protocol

Table 88. Definition of Request_ﬂags LSBs

Bit Flag Decription

Subcarrier_ﬂag

Datarate_ﬂag

(1)

2 Inventory_ﬂag

3 Protocol_extension_ﬂag

1. Subcarrier_ﬂag and Datarate_ﬂag refer to the VICC-to-VCD communication.

Table 89. Definition of Request_ﬂags MSBs when Inventory_ﬂag value is 0

Bit Flag Decription

0 : The command is processed according to the value of Address_ﬂag

Select_ﬂag

Address_ﬂag

6 Option_ﬂag

7 RFU_ﬂag

1. Select_ﬂag=1 and Address_ﬂag=1 is an invalid case, a request with such setting is ignored by the ST25TVxxxC device.

2. The SELECTED state is deﬁned in section 6.2.8

(1)

1 : UID ﬁeld not present. The command is processed only by the VICC in SELECTED state

0 : UID ﬁeld not present. command is processed by any VICC

(1)

1 : UID ﬁeld present. command is processed only by the VICC whose UID matches the ﬁeld value

0 : Option not activated

1 : Option activated

0 : Unless otherwise speciﬁed

1 : Not supported (RFU)

0 : A single subcarrier is used by the VICC

1 : Two subcarriers are used by the VICC

0 : Low data rate is used by the VICC

1 : High data rate used by the VICC

0 : Bits 4 to 7 are described by Table 89

1 : Bits 4 to 7 are described by Table 90

0 : No protocol format extension

1 : Not supported (RFU)

(2)

Table 90. Definition of Request_ﬂags MSBs when Inventory_ﬂag value is 1

Bit

4 AFI_ﬂag

5 Nb_slots_ﬂag

6 Option_ﬂag

7 RFU_ﬂag

6.2.4 Response format

A response frame consists in:

• a SOF

• response ﬂags

• response data

• a CRC

• an EOF

Flag Decription

0 : AFI ﬁeld is not present

1 : AFI ﬁeld is present

0 : 16 slots mode

1 : 1 slot mode

0 : Option not activated

1 : Option activated

0 : Unless otherwise speciﬁed

1 : Not supported (RFU)

DS13304 - Rev 3

page 39/87

Page 40

ST25TV02KC ST25TV512C

RF protocol

Table 91. General response format

SOF Response_ﬂags Response_data CRC_B EOF

- 8 bits optional 16 bits -

6.2.5 Response ﬂags

In a response frame, the Response_ﬂags ﬁeld indicates how actions have been performed by the ST25TVxxxC and whether corresponding ﬁelds are present or not.

The Response_ﬂags ﬁeld consists of eight bits indexed from 0 to 7.

Note: Indexing of bits starts from 0 to comply with the convention used in this speciﬁcation, however note that indexing

of these bits starts at 1 in the ISO/IEC 15693 speciﬁcation.

Table 92. Definition of Response_flags

Bit Flag Description

0 Error_ﬂag

RFU

0 : No error

1 : Error detected. Error code present in the Data ﬁeld

0 : Unless otherwise speciﬁed

1 : Not supported (RFU)

6.2.6 Response and error codes

If the Error_ﬂag ﬁeld is set to 1 by the ST25TVxxxC in the response, an Error code ﬁeld is present and provides information about the error that occurred.

If an error occurs while processing a command, the ST25TxxxC remains silent instead of responding a frame with Error_ﬂag set to 1 when :

• Inventory_ﬂag is set to 1

• Inventory_ﬂag, Select_ﬂag and Address_ﬂag are set to 0

Error codes not speciﬁed in Table 93 are reserved for future use.

Table 93. General response format when Error_ﬂag equals 1

SOF Response_ﬂags Error_code CRC_B EOF

- 01h 8 bits 16 bits -

Error code Description

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

0Fh Error with no information given

10h Requested data not available

Table 94. Definition of response error codes

DS13304 - Rev 3

page 40/87

Page 41

Error code Description

6.2.7 Modes

The term “mode” refers to the mechanism used in a command to specify the set of VICC devices that must process a request with Inventory_ﬂag set to 0. Three modes are deﬁned depending on the values of Address_ﬂag and Select_ﬂag deﬁned in Section 6.2.3 Request ﬂags.

Addressed mode

When Address_ﬂag is set to 1 (Addressed mode), the request contains the UID (unique ID) of the addressed VICC.

Any ST25TVxxxC receiving a request with the Address_ﬂag set to 1 compares the received UID to its own. If they match the device processes the request (if possible) and returns a response to the VCD as speciﬁed in the command description. Otherwise the device remains silent.

ST25TV02KC ST25TV512C

RF protocol

11h Requested data is already locked and thus cannot be locked again

12h Requested data is locked and its content cannot be changed

13h Programmation of requested data failed

14h Lock of requested data failed

15h Requested data is protected in read

Select mode

When Select_ﬂag is set to 1 (Select mode), the request frame does not contain a UID field. Only the VICC in SELECTED state that receives a request with Select_ﬂag set to 1 processes it and returns a response to the VCD as speciﬁed in the command description.

The SELECTED state is deﬁned in section 6.2.8. The system design ensures that only one ST25TVxxxC can be in the SELECTED state at a given time.

Non-Addressed mode (broadcast request)

When Address_ﬂag and Select_ﬂag are set to 0 (Non-Addressed mode), the request frame does not contain a UID field.

Several VICC may answer to a request in Non-Addressed mode, unlike the Addressed and Select modes where at most one VICC is expected to answer.

6.2.8 ISO15693 states

• POWER-OFF

• READY

• QUIET

• SELECTED

Transitions between these states are speciﬁed in Figure 9. ISO15693 state transition diagram.

POWER-OFF state

The ST25TVxxxC is in RF POWER-OFF state when it does not receive enough energy from the VCD.

DS13304 - Rev 3

READY state

The ST25TVxxxC boots in READY state when it receives enough energy from the VCD.

When in the READY state, the ST25TVxxxC processes requests in Addressed, or Non-Addressed mode, or with Inventory_ﬂag set to 1. Requests in Select mode are ignored.

QUIET state

When in the QUIET state, the ST25TVxxxC processes any request in Addressed mode. Requests in Select or Non-Addressed mode are ignored (except the ResetToReady command in Non-Addressed mode). Requests with Inventory_flag set to 1 are ignored.

page 41/87

Page 42

ST25TV02KC ST25TV512C

SELECTED state

In the SELECTED state, the ST25TVxxxC processes requests in any addressing mode:

• Request in Select mode

• Request in Addressed mode

• Request in Non-Addressed mode

• Request with Inventory_ﬂag set to 1

Table 95. Request_flags values depending on adressing mode

Request_ﬂags Non-Addressed Select

Addressed

Inventory_ﬂag 0 0 0 1

Select_ﬂag 0 1 0 -

Address_ﬂag 0 0 1 -

1. assuming UID and Inventory parameter values matching the ST25TVxxxC register values

Table 96. Device response depending on state and addressing mode

ISO15693 state

READY X - X X

SELECTED X X X X

QUIET

1. assuming UID and Inventory parameter values matching the ST25TVxxxC register values

2. All Non-Addressed requests are ignored in QUIET state, except the Non-Addressed ResetToReady request

Non-Addressed Select

(2)

- X -

Addressed

(1)

RF protocol

Inventory

(1)

Out of RF field

RF_OFF

after t

Any other command where the

Address_Flag is set AND where

the Inventory_Flag is not set

Figure 9. ISO15693 state transition diagram

Power-off

Quiet

Out of field after t

RF_OFF

Inventory

Reset to ready

Stay quiet(UID)

Select (UID)

In RF field

Ready

Select with (# UID)

Stay quiet(UID)

Any other command

Reset to ready where

Select_Flag is set or

where Select_Flag

is not set

Select (UID)

Selected

Any other command

Out of RF field

RF_OFF

after t

DS13304 - Rev 3

page 42/87

Page 43

ST25TV02KC ST25TV512C

RF protocol

The ST25TVxxxC returns to the POWER-OFF state if the tag is out of the ﬁeld for at least t of the state transition method is that only one ST25TVxxxC must be in the SELECTED state at any given time.

6.2.9 Custom states

In addition to the ISO15693 states described in the previous section, the ST25TVxxxC supports two custom states :

• UNTRACEABLE

• KILLED

Transitions with these states are speciﬁed in Figure 10.

UNTRACEABLE state

When in UNTRACEABLE state, the ST25TVxxxC ignores all incoming requests except :

• the GetRandomNumber request in Non-Addressed mode

• the ToggleUntraceable request in Non-Addressed mode

• the Inventory request if value of DIS_INV register at boot-time was 0b

• the ReadSingleBlock request in Addressed mode if value of DIS_INV register at boot-time was 0b and Block_number parameter is set to 00h

KILLED state

When in KILLED state, the ST25TVxxxC ignores all incoming requests.

Figure 10. ST25TVxxxC state transition diagram

RF_OFF

. The intention

POWER- OFF

(1)

RF_OFF

READY

ISO15693

UNTRACEABLE

Boot in UNTRACEABLE state

Out of RF field after t

ToggleUntraceable

command

ToggleUntraceable

command

(4)

(3)

QUIET SELECTED

1. ST25TVxxxC boots in UNTRACEABLE state when:

– in RF ﬁeld

– the value of KILL_CMD register is 0b

– either of the following conditions is met :

◦ the value of UNTR_CMD register is 1b

◦ the value of UNTR_DFT register is 01b

◦ the value of UNTR_DFT register is 10b with tamper loop closed

◦ the value of UNTR_DFT register is 11b with tamper loop open

Out

RF FIELD

Boot in KILLED state

Out of RF field after t

command

RF_OFF

Kill

(2)

(5)

KILLED

DS13304 - Rev 3

page 43/87

Page 44

ST25TV02KC ST25TV512C

2. ST25TVxxxC boots in KILLED state when:

– in RF ﬁeld

– the value of KILL_CMD register is 1b

3. ST25TVxxxC goes from UNTRACEABLE to READY state on a successful ToggleUntraceable command requested in Non-addressed mode which sets UNTR_CMD register to 0b

4. ST25TVxxxC goes from READY/SELECTED/QUIET to UNTRACEABLE state on a successful ToggleUntraceable command requested in Addressed mode which sets UNTR_CMD register to 1b

5. ST25TVxxxC goes from READY/SELECTED/QUIET to KILLED state on a successful Kill command requested in Addressed mode which permanently sets KILL_CMD register to 1b

When the ST25TVxxxC boots in UNTRACEABLE state, the value of UID register is masked(except in the response to a ReadConﬁguration request (FID=FEh, PID=01h) where the content of the UID register is always returned without masking.) with the Untraceable UID value speciﬁed in section 7.1 until it returns to POWER- OFF state,

When the ST25TVxxxC boots in READY state and enters the UNTRACEABLE state with an explicit ToggleUntraceable command, the value of UID register is masked with the Untraceable UID value speciﬁed in Section 7.1 Untraceable UID until it leaves the UNTRACEABLE state.

While the ST25TV02KC is in UNTRACEABLE state:

• the value of AFI register is masked with 00h

• the value of DSFID register is masked with 00h

Note: When UID and/or AFI registers are masked, the resulting values have to be used:

• in Mask_value and AFI parameters of requests with Inventory_ﬂag=1b

• in UID parameter of requests with Inventory_ﬂag=0b and Address_ﬂag=1b

Timing deﬁnition

6.3

Timing deﬁnition

Note: The tolerance on a speciﬁc timing is ± 32/f

t1: VICC response delay for read-alike commands

For a read-alike command - example a command not invoking a programmation of the EEPROM - the VICC waits for a time t1 starting at the rising edge of the EOF in the request received from the VCD, before transmitting its

response. Values of t1 are given in Table 97. Timing values.

Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC

VCD

ST25TVxxxC

SOF

Read-alike

request

t2: VCD new request delay

t2 is the time after which the VCD may send an EOF to switch to the next slot when one or more VICC responses have been received after an Inventory request with Nb_slots_ﬂag set to 0. It starts from the reception of the EOF

from the VICCs.

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for transmitting the VCD request to the VICC.

EOF

SOF

Read-alike

response

EOF

DS13304 - Rev 3

page 44/87

Page 45

ST25TV02KC ST25TV512C

Timing deﬁnition

t2 is also the time after which the VCD may send a new request to the VICC, as described in Figure 8. ISO15693

protocol timing.

Values of t2 are given in Table 97. Timing values.

t3: VCD new request delay when no response is received from the VICC

t3 is the time after which the VCD may send an EOF to switch to the next slot when no response has been received from the VICC after an Inventory request with Nb_slots_ﬂag set to 0.

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for transmitting the VCD request to the VICC.

Starting from the rising edge of the request EOF sent by the VCD:

• If this EOF is 100% modulated, the VCD waits for a time at least equal to t3min for 100% modulation before sending a new EOF.

• If this EOF is 10% modulated, the VCD waits for a time at least equal to t3min for 10%

• modulation before sending a new EOF.

Table 97. Timing values

Minimum (min) values Nominal (nom) values Maximum (max) values

100% modulation 10% modulation

EOF

1max

4320 / fC = 318.6 µs 4352 / fC = 320.9 µs

4192 / fC = 309.2 µs

(2)

(3)

SOF

1max

(2)

(4)

NRT

2min

10 ms No

4384 / fC = 323.3 µs

No No

No t

3nom

EOFnom

No t

20 ms

3max

1. VCD request will not be interpreted during the ﬁrst milliseconds following the ﬁeld rising.

2. t

3. t

does not apply for write-alike commands. Specific timing constraints for write-alike commands are defined by Wt and

1max

(see below)

EOF

is the time taken by the VICC to transmit an SOF to the VCD. t

SOF

depends on the response data rate: High data rate

SOF

or Low data rate.

4. t

is the nominal response time of the VICC. t

NRT

and the size of expected response frame.

depends on the response data rate, the subcarrier modulation mode,

NRT

Wt: VICC response delay for write-alike commands with Option_flag=0

For a write-alike command with option_flag=0, for instance a command involving a programmation of the EEPROM, the VICC waits for a time Wt starting at the rising edge of the EOF in the request received from

the VCD, before transmitting its response.

The Wt time is equal to t

+ a multiple of 4096 / fC (= 302 μs).

1nom

Figure 12. Write-alike frame exchange between VCD and ST25TVxxxC when Option_flag=0

(1)

DS13304 - Rev 3

VCD

ST25TVxxxC

SOF

Write-alike

request

(Option_flag=0)

EOF

SOF

Write-alike

response

EOF

page 45/87

Page 46

: EOF request delay for write-alike commands with Option_flag=1

EOF

ST25TV02KC ST25TV512C

Timing deﬁnition

For a write-alike command with Option_flag=1, the VCD waits for a time t

starting at the rising edge of the

EOF

EOF in the request frame, before sending an isolated EOF request which triggers the response of the VICC.

Upon reception of the isolated EOF request, the VICC waits for a time t1 starting at the rising edge of the isolated EOF request, before transmitting its response.

Authorized values of t

are given in Table 97. Timing values.

EOF

Figure 13. Write-alike frame exchange between VCD and ST25TVxxxC when Option_flag=1

VCD

ST25TVxxxC

Write-alike

SOF EOF

request

(Option_flag=1)

EOF

SOF

Write-alike

response

EOF

DS13304 - Rev 3

page 46/87

Page 47

6.4 RF commands

The ST25TVxxxC supports the following RF command set:

• Inventory, used to perform the anticollision sequence.

• StayQuiet, used to put the ST25TVxxxC in QUIET state, where it responds only to commands in Addressed mode.

• ReadSingleBlock, used to read the 32 bits of a block and its locking status.

• WriteSingleBlock, used to write and verify the new content for an update of a 32 bits block, provided that the write access is granted.

• LockBlock, used to permanently forbid the write access to the selected block.

• ReadMultipleBlocks, used to read the content of a range of blocks and their locking status.

• Select, used to put the ST25TVxxxC in SELECTED state. After this command, the ST25TVxxxC processes all commands requested with Select_ﬂag set.

• ResetToReady, used to put the ST25TVxxxC in the READY state.

• WriteAFI, used to write an 8-bit value in the AFI register.

• LockAFI, used to lock the AFI register.

• WriteDSFID, used to write an 8-bit value in the DSFID register.

• LockDSFID, used to lock the DSFID register.

• GetSystemInfo and ExtendedGetSystemInfo, used to read the standard system information values.

• GetMultipleBlockSecurityStatus, used to read the security status of a range blocks.

• ReadConﬁg, used to read conﬁguration registers.

• WriteConﬁg, used to write conﬁguration registers.

• Kill, used to permanently deactivate the tag by entering the KILLED state.

• WritePassword, used to change password of an open security session.

• PresentPassword, used to open a security session.

• GetRandomNumber, used to generate a 16 bit number.

• ToggleUntraceable, used to enter or leave the UNTRACEABLE state.

• Initiate, used to set the Initiate_ﬂag register to 1.

• InventoryInitiated, used to perform the anticollision sequence on ST25TVxxxC with Initiate_ﬂag set to 1.

Their codes are given in Table 98.

ST25TV02KC ST25TV512C

RF commands

Table 98. Command code

Opcode

01h Inventory 2Bh GetSystemInfo

02h StayQuiet 2Ch GetMultipleBlockSecurityStatus

20h ReadSingleBlock 3Bh ExtendedGetSystemInfo

21h WriteSingleBlock A0h ReadConﬁg

22h LockBlock A1h WriteConﬁg

23h ReadMultipleBlocks A6h Kill

25h Select B1h WritePassword

26h ResetToReady B3h PresentPassword

27h WriteAFI B4h GetRandomNumber

28h LockAFI BAh ToggleUntraceable

29h WriteDSFID D1h InventoryInitiated

2Ah LockDSFID D2h Initiate

Command Opcode Command

DS13304 - Rev 3

page 47/87

Page 48

6.4.1 Inventory

When receiving the Inventory request, the ST25TVxxxC sends a response if the parameters match the values of the UID and AFI registers.

Inventory_ flag is set to 1 : bits 4 and 5 of Request_ﬂags respectively code AFI_ﬂag and Nb_slots_flag.

Option_ﬂag is set to 0 : no option supported.

SOF

- 00xx01xxb 01h 8 bits 8 bits 0-64 bits 16 bits -

1. AFI ﬁeld present when Request_ﬂags=00x101xxb

Request parameters and data include :

• AFI parameter if AFI_ﬂag is set to 1

• Mask_length in bits, ≤ 60 when Nb_slots_ﬂag = 0b, ≤ 64 when Nb_slots_ﬂag = 1b

• Mask_value, size in bytes is (Mask_length + 7)/8, not present if Mask_length = 00h

Table 99. Inventory request format

Request_ﬂags Opcode

Table 100. Inventory response format

AFI

ST25TV02KC ST25TV512C

RF commands

(1)

Mask_length Mask_value CRC_B EOF

SOF Response_ﬂags DSFID UID CRC_B EOF

- 00h 8 bits 64 bits 16 bits -

When Error_ﬂag is set to 0, response data include :

• DSFID register value

• UID register value

The ST25TVxxxC does not generate any answer in case of error.

When the VICC responds to an Inventory request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC.

When Nb_slots_ﬂag is set to 0, the VCD issues 15 EOF requests after the initial request from Table 99. Inventory

request format, with the following timings described in Section 6.3 Timing deﬁnition:

• if the VICC responds to an EOF request, the timing of the frame exchange is that of a readalike command

• if the VCD receives a response from one or more VICCs, it waits for a time t2 before sending the next EOF request

• if the VCD does not receive a response from any VICC, it waits for a time t3 before sending the next EOF request

6.4.2 StayQuiet

When receiving the StayQuiet request:

• the ST25TVxxxC enters the QUIET state if no error occurs, and does NOT send back a response.

• there is NO response to the StayQuiet command even if an error occurs.

Select_ﬂag is set to 0 and Address_ﬂag is set to 1 : the StayQuiet request must be issued in Addressed mode.

Option_flag is set to 0 : no option supported.

DS13304 - Rev 3

Table 101. StayQuiet request format

SOF Request_ﬂags Opcode UID CRC_B EOF

- 001000xxb 02h 64 bits 16 bits -

Request parameters and data include :

• UID parameter

page 48/87

Page 49

ST25TV02KC ST25TV512C

When in QUIET state:

• the ST25TVxxxC does not process any request if Inventory_ﬂag is set to 1,

• the ST25TVxxxC processes only requests with Address_ﬂag set to 1.

The ST25TVxxxC exits the QUIET state:

• when it is reset (power off).

• on a successful Select request, it then goes to the SELECTED state.

• on a successful ResetToReady request, it then goes to the READY state.

Figure 14. Stay Quiet frame

RF commands

VCD

ST25TVxxxC

6.4.3 ReadSingleBlock

When receiving the ReadSingleBlock request, the ST25TVxxxC reads the requested block and sends back its 32-bit value in the response.

ReadSingleBlock command is applicable and successful, if and only if the requested block is available and has granted read access (ie, parent area not protected in Read or security session open).

When Option_ﬂag is set to 1, the Block Security Status of the requested block is included in the response.

SOF

- 0xxx00xxb 20h 64 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_ﬂlags=0x1000xxb

Request parameters and data include :

• UID parameter if Address_ﬂag is set to 1

• Block_number coded on 1 byte

Request_ﬂags Opcode

SOF

Stay Quiet

request

Table 102. ReadSingleBlock request format

UID

(1)

Block_number CRC_B EOF

EOF

Table 103. ReadSingleBlock response format when Error_ﬂag equals 0

SOF

- 00h 8 bits 32 bits 16 bits -

1. BSS ﬁeld present when Request_ﬂags=01xx00xxb.

Response_ﬂags

BSS

(1)

Data CRC_B EOF

When Error_ﬂag is set to 0, response data include :

• Block security status if Option_ﬂag is set to 1 (see Table 31. Block security status)

• Four bytes of block data

Note: The Data field from Table 103 may be impacted by the ANDEF feature (see Section 5.4.2 Augmented NDEF

description)

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 104 in a ReadSingleBlock response.

DS13304 - Rev 3

page 49/87

Page 50

Error code Description

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested block not available

15h Read access to requested block is protected and security session is closed

When the VICC responds to a ReadSingleBlock request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC.

6.4.4 WriteSingleBlock

When receiving the WriteSingleBlock request, the ST25TVxxxC writes the data contained in the request to the targeted block and reports whether the write operation was successful in the response.

WriteSingleBlock command is applicable and successful, if and only if the requested block is available and has granted write access (ie, the block is not locked, area not protected in Write or security session open).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

- 0xxx00xxb 21h 64 bits 8 bits 32 bits 16 bits -

1. UID ﬁeld present when Request_ﬂlags=0x1000xxb

Request_ﬂags Opcode

ST25TV02KC ST25TV512C

Table 104. ReadSingleBlock error codes when Error_ﬂag equals 1

Table 105. WriteSingleBlock request format

UID

(1)

Block_number Data CRC_B EOF

RF commands

Request parameters and data include :

• UID parameter if Address_ﬂag is set to 1

• Block_number coded on 1 byte

• Four bytes of block data

Note: The Data field from Table 105 is not impacted by the ANDEF feature (see Section 5.4.2 Augmented NDEF

description)

Table 106. WriteSingleBlock response format when Error_ﬂag equals 0

SOF

- 00h 16 bits -

Response_ﬂags CRC_B EOF

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 107 in a WriteSingleBlock response.

Table 107. WriteSingleBlock error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested block not available

12h Write access to requested block is protected and security session is closed

13h Programmation of requested block failed

Description

DS13304 - Rev 3

When the VICC responds to a WriteSingleBlock request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

page 50/87

Page 51

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the data into the memory.

6.4.5 LockBlock

When receiving the LockBlock request, the ST25TVxxxC locks the corresponding block value permanently to protect its content against new writing.

LockBlock command is applicable and successful, if and only if the requested block is available and has granted write access (ie, the block is not locked, area not protected in Write or security session open).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

- 0xxx00xxb 22h 64 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_flags =0x1000xxb

Request parameters and data include :

• UID parameter if Address_ﬂag is set to 1

• Block_number coded on 1 byte

Table 108. LockBlock request format

Request_ﬂags Opcode

UID

ST25TV02KC ST25TV512C

RF commands

(1)

Block_number CRC_B EOF

Table 109. LockBlock response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

When Error_flag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_flag is set to 1, Error_code ﬁeld may take the values of Table 110 in a LockBlock response.

Table 110. LockBlock error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested block not available

11h Requested block is already locked

12h Write access to requested block is protected and security session is closed

14h Lock of requested block failed

Description

When the VICC responds to a LockBlock request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the LCK_BLOCK register into the memory.

6.4.6 ReadMultipleBlocks

When receiving the ReadMultipleBlocks request, the ST25TVxxxC reads the selected blocks and sends back their value in multiples of 32 bits in the response.

ReadMultipleBlocks command is applicable and successful, if and only if the ﬁrst block requested is available and has granted read access (ie, parent area not protected in Read or security session open).

When the requested range of blocks ends beyond the user memory or in an area without read access authorized, the range of blocks used for the response data is truncated before the ﬁrst block not available / not readable.

When Option_ﬂag is set to 1, the Block Security Status of the blocks read are included in the response.

DS13304 - Rev 3

page 51/87

Page 52

ST25TV02KC ST25TV512C

RF commands

Table 111. ReadMultipleBlocks request format

SOF Request_ﬂags Opcode

- 0xxx00xxb 23h 64 bits 8 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_flags=0x1000xxb

Request parameters and data include :

• UID parameter if Address_ﬂag is set to 1

• Block_number coded on 1 byte, requested range of blocks starts at Block_number

• Additional_blocks coded on 1 byte, requested range of blocks ends at Block_number + Additional_blocks

Table 112. ReadMultipleBlocks response format when Error_ﬂag equals 0

SOF

- 00h

1. BSS ﬁeld present when Request_ﬂags=01xx00xxb

2. Repeated as needed

Response_ﬂags

When Error_ﬂag is set to 0, response data include for each block :

• Block security status if Option_ﬂag is set to 1 (see Table 31. Block security status)

• Four bytes of block data

Note: The Data field from Table 112 may be impacted by the ANDEF feature (see Section 5.4.2 Augmented NDEF

description)

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 113 in a ReadMultipleBlocks response.

UID

(1)

Block_number Additional_blocks CRC_B EOF

BSS

8 bits

(1)

(2)

Data CRC_B EOF

32 bits

(2)

16 bits -

Error code

When the VICC responds to a ReadMultipleBlocks request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC.

6.4.7 Select

When receiving the Select request:

• If the UID parameter matches its own UID, the ST25TVxxxC enters or stays in the SELECTED state and sends a response.

• If the UID parameter does not match its own UID, the selected ST25TVxxxC returns to the READY state and does not send a response.

• If an error occurs, the ST25TVxxxC remains in its current state.

Select_ﬂag is set to 0 and Address_ﬂag is set to 1 : the Select request must be issued in Addressed mode.

Option_ﬂag is set to 0 : no option supported.

Table 113. ReadMultipleBlocks error codes when Error_flag equals 1

Description

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested block not available

15h Read access to requested block is protected and security session is closed

Table 114. Select request format

DS13304 - Rev 3

SOF Request_ﬂags Opcode UID CRC_B EOF

- 001000xxb 25h 64 bits 16 bits -

page 52/87

Page 53

ST25TV02KC ST25TV512C

RF commands

Request parameters and data include :

• UID parameter

Table 115. Select response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

• When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 116 in a Select response.

Table 116. Select error codes when Error_ﬂag equals 1

Error code Description

02h Invalid request format

03h Invalid Request_ﬂags value

When the VICC responds to a Select request, the timing of the frame exchange is that of a read-alike command as depicted inFigure 11. Read-alike frame exchange between VCD and ST25TVxxxC.

6.4.8 ResetToReady

When receiving the ResetToReady request:

• the ST25TVxxxC enters or stays in the READY state if no error occurs.

• in SELECTED state, the ST25TVxxxC responds an error when Addressed mode is used.

• in QUIET state, the ST25TVxxxC handles the request even if Non-addressed mode is used.

• If an error occurs, the ST25TVxxxC remains in its current state.

Option_flag is set to 0 : no option supported.

SOF

- 00xx00xxb 26h 64 bits 16 bits -

1. UID ﬁeld present when Request_flags=0x1000xxb

Request parameters and data include:

• UID parameter if Address_flag is set to 1

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

Table 117. ResetToReady request format

Request_ﬂags Opcode

UID

(1)

CRC_B EOF

Table 118. ResetToReady response format when Error_ﬂag equals 0

DS13304 - Rev 3

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 119 in a ResetToReady response.

Table 119. ResetToReady error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

Description

page 53/87

Page 54

When the VICC responds to a ResetToReady request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC.

6.4.9 WriteAFI

When receiving the WriteAFI request, the ST25TVxxxC programs the 8-bit AFI register.

WriteAFI command is applicable and successful, if and only if the WriteAFI command is allowed (ie, AFI is not locked, AFI_PROT=0b or AREA1 security session open).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

- 0xxx00xxb 27h 64 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include:

• UID parameter if Address_ﬂag is set to 1

• AFI parameter coded on 1 byte, used to program the AFI register

Table 120. WriteAFI request format

Request_ﬂags Opcode

UID

ST25TV02KC ST25TV512C

RF commands

(1)

AFI CRC_B EOF

SOF Response_ﬂags CRC_B EOF

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 122 in a WriteAFI response.

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

12h LCK_AFI=1b or (AFI_PROT=1b and AREA1 security session is closed)

13h Programmation of AFI register failed

When the VICC responds to a WriteAFI request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the AFI register into the memory.

6.4.10 LockAFI

When receiving the LockAFI request, the ST25TVxxxC locks the AFI register permanently.

LockAFI command is applicable and successful, if and only if the LockAFI command is allowed (ie, AFI not already locked, AFI_PROT=0b or AREA1 security session open).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

Table 121. WriteAFI response format when Error_ﬂag equals 0

- 00h 16 bits -

Table 122. WriteAFI error codes when Error_ﬂag equals 1

Description

DS13304 - Rev 3

Table 123. LockAFI request format

SOF

- 0xxx00xxb 28h 64 bits 16 bits -

Request_ﬂags Opcode

UID

(1)

CRC_B EOF

page 54/87

Page 55

ST25TV02KC ST25TV512C

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• UID parameter if Address_ﬂag is set to 1

Table 124. LockAFI response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 125 in a LockAFI response.

Table 125. LockAFI error codes when Error_ﬂag equals 1

Error code Description

02h Invalid request format

03h Invalid Request_ﬂags value

11h LCK_AFI=1b : Successful LockAFI command already occured

12h AFI_PROT=1b and AREA1 security session is closed

14h Programmation of LCK_AFI register failed

RF commands

When the VICC responds to a LockAFI request, the timing of the frame exchange is that of a write-alike command as described in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the LCK_AFI register into the memory.

6.4.11 WriteDSFID

When receiving the WriteDSFID request, the ST25TVxxxC programs the 8-bit DSFID register. WriteDSFID command is applicable and successful, if and only if the DSFID register is not locked (LCK_DSFID=0b).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

- 0xxx00xxb 29h 64 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include:

• UID parameter if Address_ﬂag is set to 1.

• DSFID parameter coded on 1 byte, used to program the DSFID register

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

Table 126. WriteDSFID request format

Request_ﬂags Opcode

UID

(1)

DSFID CRC_B EOF

Table 127. WriteDSFID response format when Error_ﬂag equals 0

DS13304 - Rev 3

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 128 in a WriteDSFID response.

page 55/87

Page 56

Error code Description

When the VICC responds to a WriteDSFID request, the timing of the frame exchange is that of a write-alike command as described in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the DSFID register into the memory.

6.4.12 LockDSFID

When receiving the LockDSFID request, the ST25TVxxxC locks the DSFID register permanently. LockDSFID command is applicable and successful, if and only if the DSFID register is not already locked (LCK_DSFID=0b).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

- 0xxx00xxb 2Ah 64 bits 16 bits -

1. UID ﬁeld present when Request_flags=0x1000xxb

Table 128. WriteDSFID error codes when Error_ﬂag equals 1

02h Invalid request format

03h Invalid Request_ﬂags value

12h LCK_DSFID=1b : DSFID register is locked

13h Programmation of DSFID register failed

Table 129. LockDSFID request format

Request_ﬂags Opcode

ST25TV02KC ST25TV512C

RF commands

UID

(1)

CRC_B EOF

Request parameters and data include:

• UID parameter if Address_ﬂag is set to 1

Table 130. LockDSFID response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

When Error_ﬂag is set to 0, no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 131 in a LockDSFID response.

Table 131. LockDSFID error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

11h LCK_DSFID=1b : Successful LockDSFID command already occured

14h Programmation of LCK_DSFID register failed

Description

When the VICC responds to a LockDSFID request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the LCK_DSFID register into the memory.

DS13304 - Rev 3

page 56/87

Page 57

6.4.13 GetSystemInfo

When receiving the GetSystemInfo request, the ST25TVxxxC sends back its information data in the response.

Option_ﬂag is set to 0 : no option supported.

SOF Request_ﬂags Opcode

- 00xx00xxb 2Bh 64 bits 16 bits -

1. UID ﬁeld present when Request_flags=0x1000xxb

Request parameters and data include:

• UID parameter if Address_ﬂag is set to 1

SOF Response_ﬂags Information_ﬂags UID DSFID AFI Memory_size IC_ref CRC_B EOF

- 00h 0Fh 64 bits 8 bits 8 bits 16 bits 08h 16 bits -

When Error_ﬂag is set to 0, response data include :

• Information_ﬂags coded on 1 byte, set to 0Fh (DSFID, AFI, Memory_size and IC_ref ﬁelds are all present).

• UID register value

• DSFID register value

• AFI register value

• Memory_size coded on 2 bytes:

– 8-MSB (03h) = Block size in number of Bytes - 1

– 8-LSB (END_MEM) = User memory size in number of Blocks - 1

• IC_REF register value

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 134 in a GetSystemInfo response.

ST25TV02KC ST25TV512C

Table 132. GetSystemInfo request format

(1)

UID

Table 133. GetSystemInfo response

RF commands

CRC_B EOF

Table 134. GetSystemInfo error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

When the VICC responds to a GetSystemInfo request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

6.4.14 GetMultipleBlockSecurityStatus

When receiving the GetMultipleBlockSecurityStatus request, the ST25TVxxxC responds the block security status of the selected blocks.

GetMultipleBlockSecurityStatus command is applicable and successful, if and only if the ﬁrst block requested is available.

When the requested range of blocks ends beyond the user memory, the range of blocks used for the response data is truncated to the last block available.

Option_ﬂag is set to 0 : no option supported.

Description

DS13304 - Rev 3

page 57/87

Page 58

ST25TV02KC ST25TV512C

RF commands

Table 135. GetMultipleBlockSecurityStatus request format

SOF Request_ﬂags Opcode

- 00xx00xxb 2Ch 64 bits 8 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• UID parameter if Address_flag is set to 1

• Block_number coded on 1 byte, requested range of blocks starts at Block_number

• Additional_blocks coded on 1 byte, requested range of blocks ends at Block_number + Additional_blocks

Table 136. GetMultipleBlockSecurityStatus response format when Error_ﬂag equals 0

SOF Response_ﬂags BSS CRC_B EOF

- 00h

1. Repeated as needed

When Error_ﬂag is set to 0, response data include for each block :

• Block security status (see Table 31. Block security status)

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 137 in a GetMultipleBlockSecurityStatus response.

UID

(1)

Block_number Additional_blocks CRC_B EOF

8 bits

(1)

16 bits -

Table 137. GetMultipleBlockSecurityStatus error codes when Error_ﬂag equals 1

Error code

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested block not available

When the VICC responds to a GetMultipleBlockSecurityStatus request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

6.4.15 ExtendedGetSystemInfo

When receiving the ExtendedGetSystemInfo request, the ST25TVxxxC sends back its information data in the response.

Option_ﬂag is set to 0 : no option supported.

SOF

- 00xx00xxb 3Bh 0xx1xxxxb 64 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• Information_request_list parameter coded on 1 byte, see Table 139 below

• UID parameter if Address_ﬂag is set to 1

Request_ﬂags Opcode Information_request_list

Description

Table 138. ExtendedGetSystemInfo request format

UID

(1)

CRC_B EOF

DS13304 - Rev 3

page 58/87

Page 59

ST25TV02KC ST25TV512C

Table 139. Information_request_list content

Bit Requested information Description

b0 DSFID

b1 AFI

b2 Memory_size

b3 IC_ref

b4 MOI 1: Information on MOI always returned in response ﬂag

b5 Command_list

b6 CSI information

b7 Ext_list 0: size of Information_request_list is 1 byte

0: DSFID not requested

1: DSFID requested

0: AFI not requested

1: AFI requested

0: VICC memory size not requested

1: VICC memory size requested

0: IC reference not requested

1: IC reference requested

0: list of supported commands not requested

1: list of supported commands requested

0: CSI list not requested

1: CSI list requested

RF commands

Table 140. ExtendedGetSystemInfo response format when Error_ﬂag equals 0

SOF

- 00h 00x0xxxxb 64 bits up to 80 bits 16 bits -

Response_ﬂags Information_ﬂags UID Information_ﬁelds CRC_B EOF

Table 141. Information_ﬂags content

Bit

b0 DSFID

b1 AFI

b2 Memory_size

b3 IC_ref

b4 MOI 0: 1 byte addressing

b5 Command_list

b6 CSI_information 0: CSI list not present

b7 Ext_info 0: size of Information_ﬂags is 1 byte

Responded information Description

0: DSFID not present in Information_fields

1 : DSFID present in Information_fields

0: AFI not present in Information_fields

1: AFI present in Information_fields

0: Memory_size not present in Information_fields

1: Memory_size present in Information_fields

0: IC_ref not present in Information_fields

1: IC_ref present in Information_fields

0: Command_list not present in Information_fields

1: Command_list present in Information_fields

DS13304 - Rev 3

Table 142. Information_ﬁelds content

(1)

DSFID

8 bits 8 bits 24 bits 08h 00003FEFh

1. Presence of information ﬁelds depends on value of Information_ﬂags

AFI

(1)

Memory_size

(1)

IC_ref

(1)

Command_list

(1)

page 59/87

Page 60

ST25TV02KC ST25TV512C

RF commands

When Error_ﬂag is set to 0, response data include :

• Information_ﬂags coded on 1 byte, deﬁning which ﬁelds are present (see Table 141)

• UID register value

• DSFID register value, present if Information_ﬂags[0]=1b

• AFI register value, present if Information_ﬂags[1]=1b

• VICC Memory size coded on 3 bytes, present if Information_ﬂags[2]=1b

– 8-MSB (03h) = Block size in number of Bytes - 1

– 16-LSB (END_MEM) = User memory size in number of Blocks - 1

• IC_REF register value, present if Information_flags[3]=1b

• VICC Command list coded on 4 bytes, present if Information_ﬂags[5]=1b

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 143 in an ExtendedGetSystemInfo response.

Table 143. ExtendedGetSystemInfo error codes when Error_ﬂag equals 1

Error code Description

02h Invalid request format

03h Invalid Request_ﬂags or Information_request_list value

When the VICC responds to an ExtendedGetSystemInfo request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

6.4.16 ReadConﬁguration

When receiving the ReadConﬁguration request, the ST25TVxxxC reads the selected conﬁguration register and sends back its value in the response.

ReadConﬁguration command is applicable and successful, if and only if the requested conﬁguration register (identiﬁed by the FID/PID pair) is available and has granted read access (i.e. read not protected, or feature not locked and CONFIG security session open).

Option_ﬂag is set to 0 : no option supported.

SOF

- 00xx00xxb A0h 02h 64 bits 8 bits 8 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter if Address_flag is set to 1

• FID parameter coded on 1 byte

• PID parameter coded on 1 byte

Request_ﬂags Opcode IC Mfg code

Table 144. ReadConfiguration request format

UID

(1)

FID PID CRC_B EOF

DS13304 - Rev 3

Table 145. ReadConfiguration response format when Error_flag equals 0

SOF

- 00h 8 to 64 bits 16 bits -

1. Size of data responded depends on the requested FID and PID values according to Table 4. List of conﬁguration registers

Response_ﬂags

Data

(1)

CRC_B EOF

When Error_ﬂag is set to 0, response data include :

• Conﬁguration register value coded on 1 to 8 bytes depending on the requested FID/PID pair (see

Table 4. List of conﬁguration registers)

page 60/87

Page 61

ST25TV02KC ST25TV512C

RF commands

Note: When a register value is coded on several bytes, it is transmitted in LSB to MSB byte order in the response to a

ReadConﬁguration request.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 146 in a ReadConﬁguration response.

Table 146. ReadConfiguration error codes when Error_flag equals 1

Error code Description

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested FID/PID not available

15h Read access to requested FID/PID is protected and CONFIG security session is closed

When the VICC responds to a ReadConﬁguration request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

6.4.17 WriteConﬁguration

When receiving the WriteConﬁguration request, the ST25TVxxxC writes the data contained in the request to the selected conﬁguration register and responds an acknowledgement if the write operation was successful.

WriteConﬁguration command is applicable and successful, if and only if the requested conﬁguration register (identiﬁed by the FID/PID pair) is available and has granted write access (i.e. feature not locked and CONFIG security session open).

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

Table 147. WriteConﬁguration request format

SOF

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request_ﬂags Opcode IC Mfg code

- 0xxx00xxb A1h 02h 64 bits 8 bits 8 bits 8-32 bits 16 bits -

UID

(1)

FID PID Data CRC_B EOF

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter if Address_ﬂag is set to 1

• FID parameter coded on 1 byte

• PID parameter coded on 1 byte

• New register value coded on 1 to 4 bytes depending on the requested FID/PID pair (see Table 4. List of

conﬁguration registers)

Note: When a register value is coded on several bytes, it is transmitted in LSB to MSB byte order in the

WriteConﬁguration request.

Table 148. WriteConﬁguration response format when Error_ﬂag equals 0

SOF

- 00h 16 bits -

Response_ﬂags CRC_B EOF

When Error_ﬂag is set to 0:

• no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• the update of the register value into the memory is successful, and the new value is immediately readable with a ReadConﬁguration request. However the effect of the new value may be active immediately or on the next RF boot sequence depending on the selected conﬁguration (see column Activation time of Table 4. List

of conﬁguration registers).

DS13304 - Rev 3

page 61/87

Page 62

ST25TV02KC ST25TV512C

RF commands

When the effect of a new conﬁguration register value is activated on the next RF boot sequence, the effect of the former configuration value lasts after the update of the register into the memory until the ST25TVxxxC is put in POWER-OFF state.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 149 in a WriteConﬁguration response.

Table 149. WriteConﬁguration error codes when Error_ﬂag equals 1

Error code Description

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

10h Requested FID/PID not available

11h Bit of LCK_CONFIG (FID=FFh,PID=00h) already set to 1b

12h Write access to requested FID/PID is protected and CONFIG security session is closed

13h Programmation of requested FID/PID (other than LCK_CONFIG) failed

14h Programmation of LCK_CONFIG (FID=FFh,PID=00h) failed

When the VICC responds to a WriteConﬁguration request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the conﬁguration register into the memory.

6.4.18 WritePassword

When receiving the WritePassword request, the ST25TVxxxC uses the data contained in the request to modify the selected password and responds an acknowledgement if the write operation was successful.

WritePassword command is applicable and successful, if and only if it preceded by a successful PresentPassword command with same password selected. Refer to Section 5.1.2 Password management for details on password management.

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter if Address_ﬂag is set to 1

• Password_id coded on 1 byte

• Password_data coded on 4 or 8 bytes according to Table 27. List of password registers

The Password_data value is obtained from the encryption of the new plain value of the password as described in Section 5.1.3 Password encryption.

Request_ﬂags Opcode IC Mfg code

- 0xxx00xxb B1h 02h 64 bits 8 bits 32 or 64 bits 16 bits -

Table 150. WritePassword request format

(1)

UID

Password_id Password_data CRC_B EOF

DS13304 - Rev 3

page 62/87

Page 63

ST25TV02KC ST25TV512C

RF commands

Danger:

If a plain value is mistakenly used in the Password_data field of the WritePassword command, the presentation of its encrypted value with the PresentPassword command fails on the ST25TVxxxC device.

Note: The behavior of the WritePassword command is different between the ST25TVxxx and ST25TVxxxC devices

regarding the encryption of the Password_data field. The Password_data field is a plain password value on the ST25TVxxx device described in datasheet DS12074, while it is an encrypted password value on the ST25TVxxxC device described in this document.

It is recommended to issue the WritePassword request in Addressed or Select mode, in order to improve the system robustness.

This ensures that password change is only applied to a speciﬁc tag/UID.

Table 151. WritePassword response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

When Error_flag is set to 0:

• no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• the update of the password into the memory is successful, and the corresponding security session remains open.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 152 in a WritePassword response.

Table 152. WritePassword error codes when Error_ﬂag equals 1

Error code

01h Invalid IC Mfg code value

02h Invalid request format, including case of invalid password size

03h Invalid Request_ﬂags value

10h Invalid Password_id value

12h Security session is closed

13h Programmation of requested password failed

Description

When the VICC responds to a WritePassword request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the password value into the memory.

There is no anti-tearing mechanism while operating the WritePassword command. Command should be applied with stable RF ﬁeld, otherwise the write operation may not complete properly, and could imply a loss/corruption of password content.

The ST25TVxxxC offers a password recovery capability when such content loss/corruption occurs, see

Section 5.1.2 Password management.

DS13304 - Rev 3

page 63/87

Page 64

6.4.19 PresentPassword

When receiving the PresentPassword request, the ST25TVxxxC compares the selected password register with the password coded in the request and responds an acknowledgment if the operation was successful.

After a successful PresentPassword command, the security session associated to the password is open as described in Section 5.1 Data protection.

Option_ﬂag is set to 0 : no option supported.

SOF

1. UID ﬁeld present when Request_ﬂags=001000xxb

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter if Address_ﬂag is set to 1

• Password_id coded on 1 byte

• Password_data coded on 4 or 8 bytes according to Table 27. List of password registers

The unique valid Password_data value is obtained from the encryption of the plain password value as described in Section 5.1.3 Password encryption.

It is recommended to issue the PresentPassword request in Addressed or Select mode, in order to improve the system robustness. This ensures that password presentation is only applied to a speciﬁc tag/UID.

Request_ﬂags Opcode IC Mfg code

- 00xx00xxb B3h 02h 64 bits 8 bits 32 or 64 bits 16 bits -

ST25TV02KC ST25TV512C

Table 153. PresentPassword request format

(1)

UID

Password_id Password_data CRC_B EOF

RF commands

Table 154. PresentPassword response format when Error_ﬂag equals 0

SOF

- 00h 16 bits -

Response_ﬂags CRC_B EOF

When Error_ﬂag is set to 0:

• no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• the presentation of the password is successful, and the corresponding security session is open.

When Error_flag is set to 1, Error_code field may take the values of Table 155 in a PresentPassword response.

All security sessions are closed if an invalid value of Password_data is presented.

Warning:

After the presentation of an invalid value of Password_data with the PresentPassword / Kill / ToggleUntraceable command, the GetRandomNumber command shall be called before attempting another password presentation with the PresentPassword command as described in

Section 5.1.3 Password encryption.

The ST25TVxxxC offers a password attempt limit capability to protect a password against brute-force attacks, see

Section 5.1.2 Password management.

Table 155. PresentPassword error codes when Error_ﬂag equals 1

Error code

01h Invalid IC Mfg code value

02h Invalid request format, including case of invalid password size

03h Invalid Request_ﬂags value

0Fh Invalid Password_data value

10h Invalid Password_id value

Description

DS13304 - Rev 3

page 64/87

Page 65

When the VICC responds to a PresentPassword request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

6.4.20 Kill

When receiving the Kill request, the ST25TVxxxC compares register PWD_CFG with the password coded in the request and responds an acknowledgment if the operation was successful.

Kill command is applicable if and only if the DIS_KILL register is set to 0b, otherwise it is ignored. After a successful Kill command, the ST25TVxxxC permanently enters the KILLED state, where it stays mute to any request.

Select_ﬂag is set to 0 and Address_ﬂag is set to 1 : the Kill request must be issued in Addressed mode.

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF Request_ﬂags Opcode IC Mfg code UID Password_id Password_data CRC_B EOF

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter

• Password_id coded on 1 byte, value shall be 00h

• Password_data coded on 4 bytes

The unique valid Password_data value is obtained from the encryption of the plain password value as described in Section 5.1.3 Password encryption

ST25TV02KC ST25TV512C

RF commands

Table 156. Kill request format

- 0x1000xxb A6h 02h 64 bits 00h 32 bits 16 bits -

Warning:

Note: The behavior of the Kill command is different between the ST25TVxxx and ST25TVxxxC devices regarding the

encryption of the Password_data field. The Password_data field is a plain password value on the ST25TVxxx device described in datasheet DS12074, while it is an encrypted password value on the ST25TVxxxC device described in this document.

Table 157. Kill response format when Error_ﬂag equals 0

SOF

- 00h 16 bits -

Response_ﬂags CRC_B EOF

When Error_ﬂag is set to 0:

• no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• the ST25TVxxxC permanently enters the KILLED state by setting the KILL_CMD register to 1b.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 158 in a Kill response.

Table 158. Kill error codes when Error_ﬂag equals 1

Error code

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

Description

DS13304 - Rev 3

page 65/87

Page 66

When the VICC responds to a Kill request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the KILL_CMD register into the memory.

6.4.21 Initiate

When receiving the Initiate request, the ST25TVxxxC sets the Initiate_ﬂag register to 1b and sends back a response. Initiate_ﬂag is automatically reset to 0b when the ST25TVxxxC enters the POWER-OFF state.

Select_ﬂag is set to 0 and Address_ﬂag is set to 0 : the Initiate request must be issued in Non- addressed mode.

Option_flag is set to 0 : no option supported.

SOF Request_ﬂags Opcode IC Mfg code CRC_B EOF

- 000000xxb D2h 02h 16 bits -

ST25TV02KC ST25TV512C

RF commands

Error code Description

0Fh Invalid Password_data value

10h Invalid Password_id value

14h Programmation of KILL_CMD failed

Table 159. Initiate request format

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

SOF Response_ﬂags DSFID UID CRC_B EOF

- 00h 8 bits 64 bits 16 bits -

When Error_ﬂag is set to 0, Initiate_ﬂag is set to 1b response data include :

• DSFID register value

• UID register value

The ST25TVxxxC does not generate any answer in case of error.

When the VICC responds to an Initiate request, the timing of the frame exchange is that of a read- alike command as depicted in Figure 11.

6.4.22 InventoryInitiated

When receiving the InventoryInitiated request, the ST25TVxxxC sends a response if Initiate_ﬂag is set to 1b and the parameters match the values of the UID and AFI registers.

Inventory_ﬂag is set to 1 : bits 4 and 5 of Request_ﬂags respectively code AFI_ﬂag and Nb_slots_ﬂag.

Option_ﬂag is set to 0 : no option supported.

SOF

1. AFI field present when Request_flags=00x101xxb

Request_ﬂags Opcode IC Mfg code

- 00xx01xxb D1h 02h 8 bits 8 bits 0-64 bits 16 bits -

Table 160. Initiate response format when Error_ﬂag equals 0

Table 161. InventoryInitiated request format

(1)

AFI

Mask_length Mask_value CRC_B EOF

DS13304 - Rev 3

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

page 66/87

Page 67

ST25TV02KC ST25TV512C

RF commands

• AFI parameter if AFI_flag is set to 1

• Mask_length in bits, ≤ 60 when Nb_slots_ﬂag = 0b, ≤ 64 when Nb_slots_ﬂag = 1b

• Mask_value, size in bytes is (Mask_length + 7)/8, not present if Mask_length = 00h

Table 162. InventoryInitiated response format when Error_ﬂag equals 0

SOF Response_ﬂags DSFID UID CRC_B EOF

- 00h 8 bits 64 bits 16 bits -

When Error_ﬂag is set to 0, response data include :

• DSFID register value

• UID register value

The ST25TVxxxC does not generate any answer in case of error.

When the VICC responds to an InventoryInitiated request, the timing of the frame exchange is that of a read-alike command as depicted in Figure 11.

When Nb_slots_ﬂag is set to 0, the VCD issues 15 EOF requests after the initial request from Table 161, with the following timings described in Section 6.3 Timing deﬁnition:

• if the VICC responds to an EOF request, the timing of the frame exchange is that of a read-alike command

• if the VCD receives a response from one or more VICCs, it waits for a time t2 before sending the next EOF request

• if the VCD does not receive a response from any VICC, it waits for a time t3 before sending the next EOF request

6.4.23 ToggleUntraceable

When receiving the ToggleUntraceable request, the ST25TVxxxC compares register PWD_UNTR with the password coded in the request and responds an acknowledgement if the operation was successful.

ToggleUntraceable command is applicable only in the following cases, otherwise it is ignored :

• the ST25TVxxxC is in READY, SELECTED or QUIET state, and the request is issued in Addressed mode (Select_ﬂag=0, Address_ﬂag=1)

• the ST25TVxxxC is in UNTRACEABLE state, and the request is issued in Non-Addressed mode (Select_ﬂag=0, Address_ﬂag=0)

After a successful ToggleUntraceable command, the ST25TVxxxC leaves or enters (depending on the addressing mode) the UNTRACEABLE state described in Section 6.2.9 Custom states.

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

• UID parameter if Address_ﬂag is set to 1

• Password_id coded on 1 byte, value shall be 03h

• Password_data coded on 4 bytes

The unique valid Password_data value is obtained from the encryption of the plain password value as described in section 5.1.3

Request_ﬂags Opcode IC Mfg code

- 0xx000xxb BAh 02h 64 bits 03h 32 bits 16 bits -

Table 163. ToggleUntraceable request format

(1)

UID

Password_id Password_data CRC_B EOF

DS13304 - Rev 3

page 67/87

Page 68

ST25TV02KC ST25TV512C

RF commands

Warning:

Note: Opcode value BAh is used for the EnableUntraceable command of the ST25TVxxx device described in

datasheet DS12074. The EnableUntraceable command has the same request format as the ToggleUntraceable command, except for the value of the Password_id field which is 00h on the ST25TVxxx device, and 03h on the ST25TVxxxC device described in this document.

Table 164. ToggleUntraceable response format when Error_ﬂag equals 0

SOF Response_ﬂags CRC_B EOF

- 00h 16 bits -

When Error_ﬂag is set to 0:

• no data is inserted between the Response_ﬂags and CRC_B ﬁelds.

• if the request was issued in Addressed mode, the ST25TVxxxC enters the UNTRACEABLE state by setting the UNTR_CMD register to 1b.

• if the request was issued in Non-addressed mode, the ST25TVxxxC enters the READY state by setting the UNTR_CMD register to 0b.

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 165 in a ToggleUntraceable response.

Table 165. ToggleUntraceable error codes when Error_ﬂag equals 1

Error code

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

0Fh Invalid Password_data value

10h Invalid Password_id value

13h Programmation of UNTR_CMD failed

When the VICC responds to a ToggleUntraceable request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the UNTR_CMD register into the memory.

6.4.24 GetRandomNumber

When receiving the GetRandomNumber request, the ST25TVxxxC responds a 16-bit random number.

When Option_ﬂag is set to 1, the response is postponed to the subsequent EOF request.

SOF Request_ﬂags Opcode IC Mfg code

- 0xxx00xxb B4h 02h 64 bits 16 bits -

1. UID ﬁeld present when Request_ﬂags=0x1000xxb

Description

Table 166. GetRandomNumber request format

UID

(1)

CRC_B EOF

DS13304 - Rev 3

Request parameters and data include :

• IC manufacturer code coded on 1 byte, value shall be 02h

page 68/87

Page 69

ST25TV02KC ST25TV512C

RF commands

• UID parameter if Address_ﬂag is set to 1

Table 167. GetRandomNumber response format when Error_ﬂag equals 0

SOF Response_ﬂags RND_NUMBER CRC_B EOF

- 00h 16 bits 16 bits -

When Error_ﬂag is set to 0, a new 16-bit value has been programmed in the RND_NUMBER register, and response data include :

• RND_NUMBER register value

When Error_ﬂag is set to 1, Error_code ﬁeld may take the values of Table 168 in a GetRandomNumber response.

Table 168. GetRandomNumber error codes when Error_flag equals 1

Error code Description

01h Invalid IC Mfg code value

02h Invalid request format

03h Invalid Request_ﬂags value

13h Programmation of RND_NUMBER failed

When the VICC responds to a GetRandomNumber request, the timing of the frame exchange is that of a write-alike command as depicted in Figure 12 and Figure 13.

During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25TVxxxC may not correctly program the RND_NUMBER register into the memory.

DS13304 - Rev 3

page 69/87

Page 70

7 Unique identiﬁer (UID)

The ST25TVxxxC ICs are uniquely identiﬁed by a 64-bit unique identiﬁer (UID). This UID complies with ISO/IEC 15693 and ISO/IEC 7816-6. The UID is a read-only code and comprises:

• 8 bytes

• magic number code E0h on 8 bits

• the IC manufacturer code “ST 02h” on 8 bits (ISO/IEC 7816-6/AM1)

• the ST25TVxxxC product code 08h on 8 bits

• a unique serial number on 40 bits

MSB LSB

b63-b56 b55-b48 b47-b40 b39-b0

E0h 02h ST product code : 08h Unique serial number

ST25TV02KC ST25TV512C

Unique identiﬁer (UID)

Table 169. UID format

7.1 Untraceable UID

When the ST25TVxxxC meets either of the following conditions :

• the current RF session started in UNTRACEABLE state

• the current state is UNTRACEABLE

then the UID register is masked with the content from Table 170 when processing request and response frames of all commands, except in the response to a ReadConﬁguration request (FID=FEh, PID=01h) where the content of the UID register is always returned without masking.

Table 170. Untraceable UID : UID value in UNTRACEABLE state

MSB LSB

b63-b56 b55-b48 b47-b40 b39-b0

E0h 02h 00h 0000000000h

Note: When several ST25TVxxxC tags responding UID from Table 170 are present in the ﬁeld of a VCD, it is not

possible to discriminate them with an anticollision procedure. Only one ST25TVxxxC IC responding Untraceable UID value should be present in the ﬁeld of a VCD for an application to work properly

DS13304 - Rev 3

page 70/87

Page 71

8 Device parameters

8.1 Maximum ratings

Stressing the device above the ratings listed in Table 171. Absolute maximum ratings may permanently damage it. These are stress ratings only and operation of the device, at these or any other conditions above those indicated in the operating sections of this speciﬁcation, is not implied. Exposure to absolute maximum rating conditions for extended periods may affect the device reliability. Refer also to the STMicroelectronics SURE Program and other relevant quality documents.

Symbol Description Min Max Unit

STG_1

STG_2

STG

MAX_ 1

ESD

1. Sawn wafer on UV tape kept in its original packing form

2. (VAC0-VAC1) peak to peak characterized on bench

3. Human body model of ANSI/ESDA/JEDEC JS-001 with C = 100 pF, R = 1500 Ω , R2 = 500 Ω

Ambient operating temperature -40 85 °C

Storage temperature for UFDFPN5 package -65 150 °C

Storage temperature for sawn wafer

Sawn wafer

(2)

Max input voltage amplitude (peak to peak) between AC0 and AC1 - 11 V

(1)

storage duration counted from ST production date

Electronic discharge voltage

Table 171. Absolute maximum ratings

(1)

(3)

on all pins

ST25TV02KC ST25TV512C

Device parameters

15 25 °C

- 9 months

- 2000 V

8.2

RF electrical parameters

This section summarizes the operating and measurement conditions, and the RF electrical parameters of the device.

The parameters in the RF characteristics table that follows are derived from tests performed under the measurement conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters.

Table 172. RF characteristics

Symbol

100

Boot_RF_1

Boot_RF_2

RF_OFF

Description

Condition

External RF signal frequency - 13.553 13.56 13.567 MHz

Low subcarrier frequency (fCC/32)

High subcarrier frequency (fCC/28)

10% carrier modulation index

100% carrier modulation index

RF boot time

(5)

(3)

150 mA/m < H < 5 A/m 10 - 30 %

150 mA/m < H < 5 A/m 95 - 100 %

TD_EVENT_UPDATE_EN=0b

and UTC_EN=0b, from H

TD_EVENT_UPDATE_EN=1b

or UTC_EN=1b, from H

RF power down duration needed to reset

the IC

(1)(2)

Min Typ Max Unit

- - 423.75 - kHz

- - 484.28 - kHz

- - 1 ms

FIELD_MIN

- - 5 ms

FIELD_MIN

- 2 - - ms

DS13304 - Rev 3

page 71/87

Page 72

ST25TV02KC ST25TV512C

RF electrical parameters

Symbol Description

TUN

BACK

MIN_1

MIN_ 2

closed

open

RET

Cycling Write cycles endurance

VCD new request delay after a response

VCD new request delay after no response

Minimum ISO15693 backscattering voltage - 10 - - mV

Min input voltage amplitude (peak to peak)

(8)

Min input voltage amplitude (peak to peak)

(8)

VICC response delay - 318.6 320.9 323.3 µs

from the VICC

Duration of Write operation

Input capacitance

between AC0 and AC1

Resistance of closed tamper loop TD0 and TD1 connected - - 50 Ω

Resistance of open tamper loop TD0 and TD1 not connected 1 - - MΩ

Retention time

(4)(7)

Condition

(6)

Max 32 bits of data - 4 - ms

f = 13.56 MHz 21.85 23 24.15 pF

Inventory and Read operations - 4.4 - V

Write operations - 4.4 - V

TA ≤ 55 °C

(1)(2)

Min Typ Max Unit

- 309 311.5 314 µs

- 323.3 - - µs

60 - - year

TA≤85°C

100000 - - cycle

1. TA=-40 to 85°C

2. All timing characterizations were performed on a reference antenna with the following characteristics:

• ISO antenna class1

• Tuning frequency = 13.7 MHz

3. Characterized on bench

4. Characterized at room temperature only, on wafer at POR level

5. Minimum time from carrier generation to start of ﬁrst request

6. VCD request in 1 out of 4 coding, VICC response in high datarate and single subcarrier

7. For design of reference antenna. Min and Max value are deduced from correlation with industrial tester limits

8. (VAC0-VAC1) peak to peak characterized on bench

DS13304 - Rev 3

page 72/87

Page 73

9 Package information

In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK packages, depending on their level of environmental compliance. ECOPACK speciﬁcations, grade deﬁnitions and product status are available at: www.st.com. ECOPACK is an ST trademark.

9.1 Sawn and bumped wafer

Contact your STMicroelectronics sales office to get the description document.

9.2 UFDFPN5 (DFN5) package information

UFDFPN5 is a 5-lead, 1.7 × 1.4 mm, 0.55 mm thickness, ultra thin fine pitch dual flat package.

Figure 15. UFDFPN5 - Outline

ST25TV02KC ST25TV512C

Package information

Pin 1

Top view

(marking side)

Bottom view

(pads side)

Pin 1

Side view

1. Maximum package warpage is 0.05 mm.

2. Exposed copper is not systematic and can appear partially or totally according to the cross section.

3. Drawing is not to scale.

4. On the bottom side, pin 1 is identified by the specific pad shape and, on the top side, pin 1 is defined from the orientation of the marking. When reading the marking, pin 1 is below the upper left package corner.

DS13304 - Rev 3

page 73/87

Page 74

ST25TV02KC ST25TV512C

UFDFPN5 (DFN5) package information

Table 173. UFDFPN5 - Mechanical data

Symbol

millimeters

Min Typ Max Min Typ Max

0.500 0.550 0.600 0.0197 0.0217 0.0236

A1 0.000 - 0.050 0.0000 - 0.0020

(2)

0.175 0.200 0.225 0.0069 0.0079 0.0089

D 1.600 1.700 1.800 0.0630 0.0669 0.0709

D1 1.400 1.500 1.600 0.0551 0.0591 0.0630

E 1.300 1.400 1.500 0.0512 0.0551 0.0591

E1 0.175 0.200 0.225 0.0069 0.0079 0.0089

X - 0.200 - - 0.0079 -

Y - 0.200 - - 0.0079 -

e - 0.400 - - 0.0157 -

L 0.500 0.550 0.600 0.0197 0.0217 0.0236

L1 - 0.100 - - 0.0039 -

k - 0.400 - - 0.0157 -

1. Values in inches are converted from mm and rounded to four decimal digits.

2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30mm from the terminal tip.

inches

(1)

Figure 16. UFDFPN5 - Recommended footprint

Pin 1

0.200

Note: Dimensions are expressed in millimeters.

0.400

1.600

0.600

0.200

0.400

DS13304 - Rev 3

page 74/87

Page 75

10 Ordering information

Example: ST25TV 02K C- A F G 3

Device type

ST25TV = NFC/RFID tag based on ISO 15693 and NFC T5T

Memory size

512 = 512 bits

02K = 2560 bits

Product version

C = Version C

Interface

A = None

T = Tamper detection

Features

F = Augmented NDEF

Package

F = 75 μm ± 10 μm bumped and sawn wafer

G = 120 μm ± 10 μm bumped and sawn wafer

H = UFDFPN5

Capacitance

3 = 23 pF

ST25TV02KC ST25TV512C

Ordering information

Table 174. Ordering information scheme

Note: Parts marked as “ES” or “E” are not yet qualified and therefore not approved for use in production. ST is

not responsible for any consequences resulting from such use. In no event will ST be liable for the customer using any of these engineering samples in production. ST’s Quality department must be contacted prior to any decision to use these engineering samples to run a qualification activity.

DS13304 - Rev 3

page 75/87

Page 76

11 List of acronyms

Acronym Deﬁnition

AFI Application family identiﬁer

ANDEF Augmented NDEF

ASCII American standard for information interchange

BSS Block security status

CC Capability container

CMD Command

CRC Cyclic redundancy check

DSFID Data storage format identiﬁer

EEPROM Electrically-erasable programmable read-only memory

EOF End of frame

FID Feature identiﬁer

GDPR General data protection regulation

HZ High impedance

IC Integrated Circuit

Id Identiﬁer

NA Not applicable

NC Not connected

NDEF NFC data exchange format

NFC Near ﬁeld communication

PID Parameter identiﬁer

POR Power on reset

PWD Password

RF Radio frequency

RFID RF identification

RFU Reserved for future use

SOF Start of frame

UFDFPN Ultra thin Fine pitch Dual Flat Package No-lead

UTC Unique tap code

TD Tamper detection

UID Unique identiﬁer

VCD Vicinity coupling device

VICC Vicinity integrated circuit card

X Any value in the range defined by the type ([0:1] for a bit, [0:F] for an hexadecimal nibble)

ST25TV02KC ST25TV512C

List of acronyms

Table 175. List of acronyms

DS13304 - Rev 3

page 76/87

Page 77

Revision history

Date Revision Changes

15-Dec-2020 1 Initial release.

Updated:

• Section 5.2.2 Unique tap code description

15-Jan-2021 2

14-Apr-2021 3

• Section 6.2.2 Request format

• Section 6.2.4 Response format

• Section 6.2.6 Response and error codes

• Section 10 Ordering information

Updated:

• Section Features

• Section 5.5.1 Privacy registers

• Section 6.2.9 Custom states

• Section 6.4.15 ExtendedGetSystemInfo

• Section 6.4.19 PresentPassword

ST25TV02KC ST25TV512C

Table 176. Document revision history

DS13304 - Rev 3

page 77/87

Page 78

ST25TV02KC ST25TV512C

Contents

1 Description ........................................................................3

1.1 Block diagram .................................................................3

1.2 Package connections ...........................................................3

2 Functional overview ...............................................................5

2.1 Block diagram .................................................................5

2.2 Application information ..........................................................5

3 Power management................................................................6

3.1 Device set ....................................................................6

3.2 Device reset ...................................................................6

4 Memory management ..............................................................7

4.1 Memory organization ...........................................................7

4.2 User memory ..................................................................8

4.3 System conﬁguration memory ....................................................9

4.3.1 System conﬁguration registers ..............................................9

4.3.2 System registers ........................................................10

5 Specific features..................................................................11

5.1 Data protection ...............................................................11

5.1.1 Data protection registers .................................................. 11

5.1.2 Password management ..................................................16

5.1.3 Password encryption.....................................................19

5.1.4 User memory protection ..................................................20

5.1.5 System configuration memory protection .....................................20

5.2 Unique tap code ..............................................................21

5.2.1 Unique tap code registers .................................................21

5.2.2 Unique tap code description ...............................................22

5.3 Tamper detection..............................................................22

5.3.1 Tamper detection registers ................................................22

5.3.2 Tamper detection description ..............................................24

5.4 Augmented NDEF .............................................................25

5.4.1 Augmented NDEF registers ...............................................25

DS13304 - Rev 3

page 78/87

Page 79

ST25TV02KC ST25TV512C

Contents

5.4.2 Augmented NDEF description ..............................................28

5.5 Consumer privacy protection ....................................................30

5.5.1 Privacy registers ........................................................30

5.5.2 Kill feature description ....................................................31

5.5.3 Untraceable feature description ............................................31

5.6 TruST25 digital signature .......................................................32

5.7 AFI protection ................................................................32

5.7.1 AFI protection registers ...................................................32

5.7.2 AFI protection description .................................................33

5.8 Inventory Initiated .............................................................33

5.9 Device identiﬁcation registers ...................................................33

6 RF Operation .....................................................................37

6.1 RF communication ............................................................37

6.1.1 Access to a ISO/IEC 15693 device ..........................................37

6.2 RF protocol ..................................................................37

6.2.1 Protocol description......................................................37

6.2.2 Request format .........................................................38

6.2.3 Request ﬂags ..........................................................38

6.2.4 Response format........................................................39

6.2.5 Response ﬂags .........................................................40

6.2.6 Response and error codes ................................................40

6.2.7 Modes ................................................................41

6.2.8 ISO15693 states ........................................................41

6.2.9 Custom states ..........................................................43

6.3 Timing deﬁnition ..............................................................44

6.4 RF commands ................................................................47

DS13304 - Rev 3

6.4.1 Inventory ..............................................................48

6.4.2 StayQuiet .............................................................48

6.4.3 ReadSingleBlock........................................................49

6.4.4 WriteSingleBlock ........................................................50

6.4.5 LockBlock .............................................................51

6.4.6 ReadMultipleBlocks......................................................51

page 79/87

Page 80

ST25TV02KC ST25TV512C

Contents

6.4.7 Select ................................................................52

6.4.8 ResetToReady .........................................................53

6.4.9 WriteAFI ..............................................................54

6.4.10 LockAFI...............................................................54

6.4.11 WriteDSFID............................................................55

6.4.12 LockDSFID ............................................................56

6.4.13 GetSystemInfo .........................................................57

6.4.14 GetMultipleBlockSecurityStatus ............................................57

6.4.15 ExtendedGetSystemInfo ..................................................58

6.4.16 ReadConﬁguration ......................................................60

6.4.17 WriteConﬁguration ......................................................61

6.4.18 WritePassword .........................................................62

6.4.19 PresentPassword .......................................................64

6.4.20 Kill ...................................................................65

6.4.21 Initiate ................................................................66

6.4.22 InventoryInitiated........................................................66

6.4.23 ToggleUntraceable ......................................................67

6.4.24 GetRandomNumber .....................................................68

7 Unique identiﬁer (UID) ............................................................70

7.1 Untraceable UID ..............................................................70

8 Device parameters ................................................................71

8.1 Maximum ratings ..............................................................71

8.2 RF electrical parameters .......................................................71

9 Package information ..............................................................73

9.1 Sawn and bumped wafer .......................................................73

9.2 UFDFPN5 package information..................................................73

10 Ordering information .............................................................75

11 List of acronyms..................................................................76

Revision history .......................................................................77

Contents ..............................................................................78

List of tables ..........................................................................82

DS13304 - Rev 3

page 80/87

Page 81

ST25TV02KC ST25TV512C

Contents

List of figures..........................................................................86

DS13304 - Rev 3

page 81/87

Page 82

ST25TV02KC ST25TV512C

List of tables

Table 1. Signal names ......................................................................4

Table 2. User memory in single area mode ........................................................8

Table 3. User memory in dual area mode .........................................................8

Table 4. List of conﬁguration registers ............................................................9

Table 5. List of system registers ............................................................... 10

Table 6. LCK_CONFIG access ............................................................... 11

Table 7. LCK_CONFIG content ...............................................................12

Table 8. LCK_BLOCK access ................................................................ 12

Table 9. LCK_BLOCK content ................................................................ 12

Table 10. RW_PROTECTION_A1 access ......................................................... 13

Table 11. RW_PROTECTION_A1 content......................................................... 13

Table 12. END_A1 access ................................................................... 13

Table 13. END_A1 content ................................................................... 13

Table 14. RW_PROTECTION_A2 access ......................................................... 14

Table 15. RW_PROTECTION_A2 content.........................................................14

Table 16. PWD_CFG access .................................................................. 14

Table 17. PWD_CFG content ................................................................. 14

Table 18. PWD_A1 access ...................................................................15

Table 19. PWD_A1 content .................................................................. 15

Table 20. PWD_A2 access ...................................................................15

Table 21. PWD_A2 content ...................................................................15

Table 22. PWD_UNTR access .................................................................15

Table 23. PWD_UNTR content ................................................................15

Table 24. RND_NUMBER access .............................................................. 16

Table 25. RND_NUMBER content .............................................................. 16

Table 26. Security session type ................................................................ 16

Table 27. List of password registers ............................................................. 16

Table 28. RND_NUMBER_4B ................................................................. 19

Table 29. RND_NUMBER_8B ................................................................. 19

Table 30. Example of 64-bit Password_data value computation .......................................... 19

Table 31. Block security status................................................................. 20

Table 32. UTC_EN access ................................................................... 21

Table 33. UTC_EN content ................................................................... 21

Table 34. UTC access ......................................................................22

Table 35. UTC content ...................................................................... 22

Table 36. TD_EVENT_UPDATE_EN access ....................................................... 22

Table 37. TD_EVENT_UPDATE_EN content ....................................................... 22

Table 38. TD_SEAL_MSG access .............................................................. 23

Table 39. TD_SEAL_MSG content .............................................................. 23

Table 40. TD_UNSEAL_MSG access ............................................................23

Table 41. TD_UNSEAL_MSG content............................................................ 23

Table 42. TD_RESEAL_MSG access ............................................................ 23

Table 43. TD_RESEAL_MSG content............................................................23

Table 44. TD_SHORT_MSG access............................................................. 23

Table 45. TD_SHORT_MSG content ............................................................24

Table 46. TD_OPEN_MSG access ..............................................................24

Table 47. TD_OPEN_MSG content .............................................................24

Table 48. TD_STATUS access................................................................. 24

Table 49. TD_STATUS content ................................................................ 24

Table 50. ANDEF_EN access ................................................................. 25

Table 51. ANDEF_EN content .................................................................26

Table 52. ANDEF_CFG access ................................................................ 26

DS13304 - Rev 3

page 82/87

Page 83

ST25TV02KC ST25TV512C

List of tables

Table 53. ANDEF_CFG content ................................................................ 26

Table 54. ANDEF_SEP access ................................................................ 26

Table 55. ANDEF_SEP content ................................................................ 26

Table 56. ANDEF_CUSTOM_LSB access.........................................................27

Table 57. ANDEF_CUSTOM_LSB content ........................................................27

Table 58. ANDEF_CUSTOM_MSB access ........................................................ 27

Table 59. ANDEF_CUSTOM_MSB content ........................................................ 27

Table 60. ANDEF_UID access .................................................................27

Table 61. ANDEF_UID content ................................................................27

Table 62. Block data read when ANDEF feature is disabled on ST25TV02KC ................................ 28

Table 63. Block data read when ANDEF feature is enabled on ST25TV02KC ................................ 28

Table 64. ANDEF ﬁelds concatenated in ANDEF_MEM ...............................................29

Table 65. KILL_CMD access .................................................................. 30

Table 66. KILL_CMD content..................................................................30

Table 67. UNTR_CMD access ................................................................. 30

Table 68. UNTR_CMD content ................................................................ 30

Table 69. PRIVACY access ................................................................... 30

Table 70. PRIVACY content .................................................................. 31

Table 71. AFI_PROT access .................................................................. 32

Table 72. AFI_PROT content..................................................................32

Table 73. LCK_DSFID access ................................................................. 33

Table 74. LCK_DSFID content.................................................................33

Table 75. LCK_AFI access ................................................................... 34

Table 76. LCK_AFI content ................................................................... 34

Table 77. DSFID access ..................................................................... 34

Table 78. DSFID content..................................................................... 34

Table 79. AFI access ....................................................................... 34

Table 80. AFI content ....................................................................... 34

Table 81. IC_REF access .................................................................... 35

Table 82. IC_REF content .................................................................... 35

Table 83. REV access ......................................................................35

Table 84. REV content ...................................................................... 35

Table 85. UID access ....................................................................... 35

Table 86. UID content .......................................................................36

Table 87. General request format ............................................................... 38

Table 88. Definition of Request_ﬂags LSBs ........................................................39

Table 89. Definition of Request_ﬂags MSBs when Inventory_ﬂag value is 0..................................39

Table 90. Definition of Request_ﬂags MSBs when Inventory_ﬂag value is 1..................................39

Table 91. General response format ............................................................. 40

Table 92. Definition of Response_flags ...........................................................40

Table 93. General response format when Error_ﬂag equals 1 ...........................................40

Table 94. Definition of response error codes ....................................................... 40

Table 95. Request_flags values depending on adressing mode .......................................... 42

Table 96. Device response depending on state and addressing mode...................................... 42

Table 97. Timing values ..................................................................... 45

Table 98. Command code ....................................................................47

Table 99. Inventory request format ..............................................................48

Table 100. Inventory response format............................................................. 48

Table 101. StayQuiet request format ............................................................. 48

Table 102. ReadSingleBlock request format ........................................................ 49

Table 103. ReadSingleBlock response format when Error_ﬂag equals 0 .....................................49

Table 104. ReadSingleBlock error codes when Error_ﬂag equals 1 ........................................ 50

Table 105. WriteSingleBlock request format ........................................................50

Table 106. WriteSingleBlock response format when Error_ﬂag equals 0 ..................................... 50

DS13304 - Rev 3

page 83/87

Page 84

ST25TV02KC ST25TV512C

List of tables

Table 107. WriteSingleBlock error codes when Error_ﬂag equals 1 ........................................50

Table 108. LockBlock request format ............................................................. 51

Table 109. LockBlock response format when Error_ﬂag equals 0 .......................................... 51

Table 110. LockBlock error codes when Error_ﬂag equals 1 ............................................. 51

Table 111. ReadMultipleBlocks request format ...................................................... 52

Table 112. ReadMultipleBlocks response format when Error_ﬂag equals 0 ................................... 52

Table 113. ReadMultipleBlocks error codes when Error_flag equals 1 ...................................... 52

Table 114. Select request format ................................................................ 52

Table 115. Select response format when Error_ﬂag equals 0 ............................................. 53

Table 116. Select error codes when Error_ﬂag equals 1 ................................................ 53

Table 117. ResetToReady request format ..........................................................53

Table 118. ResetToReady response format when Error_ﬂag equals 0....................................... 53

Table 119. ResetToReady error codes when Error_ﬂag equals 1 .......................................... 53

Table 120. WriteAFI request format .............................................................. 54

Table 121. WriteAFI response format when Error_ﬂag equals 0 ........................................... 54

Table 122. WriteAFI error codes when Error_ﬂag equals 1 ..............................................54

Table 123. LockAFI request format...............................................................54

Table 124. LockAFI response format when Error_ﬂag equals 0 ........................................... 55

Table 125. LockAFI error codes when Error_ﬂag equals 1............................................... 55

Table 126. WriteDSFID request format ............................................................ 55

Table 127. WriteDSFID response format when Error_ﬂag equals 0......................................... 55

Table 128. WriteDSFID error codes when Error_ﬂag equals 1 ............................................ 56

Table 129. LockDSFID request format ............................................................ 56

Table 130. LockDSFID response format when Error_ﬂag equals 0 .........................................56

Table 131. LockDSFID error codes when Error_ﬂag equals 1 ............................................ 56

Table 132. GetSystemInfo request format .......................................................... 57

Table 133. GetSystemInfo response.............................................................. 57

Table 134. GetSystemInfo error codes when Error_ﬂag equals 1 .......................................... 57

Table 135. GetMultipleBlockSecurityStatus request format .............................................. 58

Table 136. GetMultipleBlockSecurityStatus response format when Error_ﬂag equals 0 ........................... 58

Table 137. GetMultipleBlockSecurityStatus error codes when Error_ﬂag equals 1 .............................. 58

Table 138. ExtendedGetSystemInfo request format ................................................... 58

Table 139. Information_request_list content ........................................................ 59

Table 140. ExtendedGetSystemInfo response format when Error_ﬂag equals 0 ................................ 59

Table 141. Information_ﬂags content ............................................................. 59

Table 142. Information_ﬁelds content ............................................................. 59

Table 143. ExtendedGetSystemInfo error codes when Error_ﬂag equals 1 ................................... 60

Table 144. ReadConfiguration request format ....................................................... 60

Table 145. ReadConfiguration response format when Error_flag equals 0 .................................... 60

Table 146. ReadConfiguration error codes when Error_flag equals 1 ....................................... 61

Table 147. WriteConﬁguration request format ....................................................... 61

Table 148. WriteConﬁguration response format when Error_ﬂag equals 0 .................................... 61

Table 149. WriteConﬁguration error codes when Error_ﬂag equals 1 .......................................62

Table 150. WritePassword request format.......................................................... 62

Table 151. WritePassword response format when Error_ﬂag equals 0 ...................................... 63

Table 152. WritePassword error codes when Error_ﬂag equals 1 .......................................... 63

Table 153. PresentPassword request format ........................................................64

Table 154. PresentPassword response format when Error_ﬂag equals 0..................................... 64

Table 155. PresentPassword error codes when Error_ﬂag equals 1 ........................................ 64

Table 156. Kill request format .................................................................. 65

Table 157. Kill response format when Error_ﬂag equals 0 ...............................................65

Table 158. Kill error codes when Error_ﬂag equals 1 .................................................. 65

Table 159. Initiate request format................................................................ 66

Table 160. Initiate response format when Error_ﬂag equals 0 ............................................66

DS13304 - Rev 3

page 84/87

Page 85

ST25TV02KC ST25TV512C

List of tables

Table 161. InventoryInitiated request format ........................................................ 66

Table 162. InventoryInitiated response format when Error_ﬂag equals 0 .....................................67

Table 163. ToggleUntraceable request format ....................................................... 67

Table 164. ToggleUntraceable response format when Error_ﬂag equals 0 ....................................68

Table 165. ToggleUntraceable error codes when Error_ﬂag equals 1 ....................................... 68

Table 166. GetRandomNumber request format ...................................................... 68

Table 167. GetRandomNumber response format when Error_ﬂag equals 0 ................................... 69

Table 168. GetRandomNumber error codes when Error_flag equals 1 ...................................... 69

Table 169. UID format ....................................................................... 70

Table 170. Untraceable UID : UID value in UNTRACEABLE state ......................................... 70

Table 171. Absolute maximum ratings ............................................................ 71

Table 172. RF characteristics .................................................................. 71

Table 173. UFDFPN5 - Mechanical data...........................................................74

Table 174. Ordering information scheme........................................................... 75

Table 175. List of acronyms ...................................................................76

Table 176. Document revision history.............................................................77

DS13304 - Rev 3

page 85/87

Page 86

ST25TV02KC ST25TV512C

List of figures

Figure 1. ST25TVxxxC block diagram ...........................................................3

Figure 2. UFDFPN5 package connections ........................................................4

Figure 3. Die connections for sawn and bumped wafer ............................................... 4

Figure 4. RF power-up sequence ..............................................................6

Figure 5. Memory organization ................................................................7

Figure 6. Security sessions management ....................................................... 18

Figure 7. Example of augmented NDEF message on ST25TV02KC-T.................................... 29

Figure 8. ISO15693 protocol timing............................................................ 38

Figure 9. ISO15693 state transition diagram .....................................................42

Figure 10. ST25TVxxxC state transition diagram ................................................... 43

Figure 11. Read-alike frame exchange between VCD and ST25TVxxxC ...................................44

Figure 12. Write-alike frame exchange between VCD and ST25TVxxxC when Option_flag=0 .................... 45

Figure 13. Write-alike frame exchange between VCD and ST25TVxxxC when Option_flag=1 .................... 46

Figure 14. Stay Quiet frame.................................................................. 49

Figure 15. UFDFPN5 - Outline................................................................73

Figure 16. UFDFPN5 - Recommended footprint .................................................... 74

DS13304 - Rev 3

page 86/87

Page 87

ST25TV02KC ST25TV512C

IMPORTANT NOTICE – PLEASE READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgement.

Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of Purchasers’ products.

No license, express or implied, to any intellectual property right is granted by ST herein.

Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.

ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks. All other product or service names are the property of their respective owners.

Information in this document supersedes and replaces information previously supplied in any prior versions of this document.

DS13304 - Rev 3

page 87/87