ibm thinkpad 600x Schematics

Features

• Dual-port Nonvolatile Memory - RFID and Serial Interfaces

• Two-wire Serial Interface:

– Compatible with a Standard AT24C08 Serial EEPROM
– Programmable Access Protection to Limit Reads or Writes from Either Port
– Lock/Unlock Function, Coil Connection Detection

• RFID Interface:

– 125 kHz Carrier Frequency for Long Range Access
– 2-Wire Connection to External Coil Antenna and Tuning Capacitor
– Multi-tag Management to Handle Several Tags in the Field at Once
– 12 RFID Commands for Tag Control and Memory Read/Write
– ID Write and Lock from RFID Port

– Ultra Low Power Single Bit Write - 25 µA

• Highly-reliable EEPROM Memory

– 8K bits (1K bytes), Organized as 8 Blocks of 128 Bytes Each
– 16-byte Page Write, 10 ms Write Time
– 10 Years Retention, 100K Write Cycle Endurance

• -40°C to +85°C Operation, 2.4V to 5.5V Supply, 8-Lead JEDEC SOIC Package

Description

The AT24RF08C functions as a dual access EEPROM, with both a wired serial port
and a wireless RFID port used to access the memory. Access permissions are set
from the serial interface side to isolate blocks of memory from improper access. The
RFID interface can be powered solely fr om the atta ched coil permitti ng remote r eads
and writes of the device when VCC is not applied.

Block Diagram

Asset
Identification
EEPROM

AT24RF08C

Pin Configurations

Pin Name Function

L1
L2 Coil Connection
PROT
GND Ground
SDA Serial Data,Open Drain I/O
SCL Serial Clock Input
WP Write Protect Input
VCC Supply: 2.4V - 5.5V

Coil Connection

Protection Input

8-Pin SOIC

L1
L2

PROT

GND

1
2
3
4

VCC

8

WP

7

SCL

6

SDA

5

Rev. 1072E–09/99

1

General Overview

The AT24RF08C is intended to be pin compatible with
standard serial EEPROM devices except for pins 1, 2 and
3, which are address pins in the stand ard part. Oth er
exceptions to the AT24C08 Serial EEPROM data sheet are
noted in the “Serial EEP ROM Ex ceptions” section later in
this document . Connect ion of an ex ternal c oil antenn a and
optional tuning capacitor, normal ly via a two conductor
wire, is all that is required to complete the RFID hardware
requirements.

Throughout this document, the term “reader” is defined as
the base station that communicates with the chip. Under all
expected conditions, it actually serves as both a reader and
writer. The term ‘tag’ is used to indicate the chip when
operating as an RFID transponder with the coil attached.

All bits are sen t to or r ea d f ro m t he dev ic e, mos t si gnific an t
bit first, in a manner consistent wi th the AT24C08 Serial
EEPROM. The bit fields in this document are
correspondingly listed with the MSB on the left and the LSB
on the right.

EEPROM Organization

The EEPROM memory is bro ken up into 8 blocks of 1K
bits (128 bytes) ea ch. Within each bl ock, the memory is
physically orga nized into 8 pages of 128 bits (16 by tes)
each. In some instances, accesses take place on a 32-bi t
(4 byte) word basis. In addition to these 8K bits, there are
two more 128-bit pages t hat are us ed to store th e access
protection and ID information. There are a total of 8448 bits
of EEPROM memory available on the AT24RF08C.

Access protection (both re ad and write) is or ganized on a
block basis for blocks 1 throug h 7 and on a page and blo ck
basis for block 0. Protection information for these blocks
and pages is stored in one of the additional pages of
EEPROM memory that is addressed separately from the
main data storage array. See “Access Protection” on page
3 for more details.

The ID value ( see “ID Configuration” on page 7) is located
in the ID page of the EEPROM, the second of the additional
16 byte pages.

Writes from the serial port may include from one to 16
bytes at a time, depending on the protocol followed by the
bus master. Ac cesse s to the E EPROM from the RF ID por t
are on either a word (32 bits) or pa ge (128 bits ) basis on ly.
All page accesses must be properly aligned to the internal
EEPROM page.

The EEPROM memory offers an endurance of 100,000
write cycles per byte, with 10 year data retention. Writes to
the EEPROM and tamper bit take less than 10 ms to
complete.

Completion time for writes initiated from the RFID port are
different depending on the situation. When external power
is supplied to the chip through the VCC pin, writes to the
EEPROM and tamper bit take less than 11.8 ms when
measured from the last modulation edge before the write to
the first after the writ e. Whe n powered from t he coil pins at
125 KHz, the EEPROM write time will be 5.8 ms and the
tamper write time will be 7.9 ms.

After manufactur ing, all E EPRO M b its exce pt in the devi ce
revision byte (see “Access Protection” page 5) will be set to
a value of 1 and the tamper bit will be set to 0.

Device Access

The third device address bit in the two wire protocol that is
usually matched to A
EEPROM is internally connected high, so device
addresses A8 through AF (hex) are used to access the
memory on the chip. The general command encoding used
by the serial port for EE PRO M acces s es is shown bel ow i n
Device Access Examples, where B

is the page number within the block and A

P

2-0

address within the page. Bits denoted as “x” are ignored by
the device.

The PROT pin is used as a power good signal. When this
pin is low, the serial port is held in reset and all sticky bits
are set to one. Wh en high, acti vity on the seria l bus is
permitted.

(pin 3) on a s tand ar d AT24 C08 se ri al

2

is the block number,

2-0

is the byte

3-0

Device Access Examples

For Write Operations:

1 0 1 0 1 B

For Read Operations:

1 0 1 0 1 X X 1 D

2

0B

2 B1

AT24RF08C

0 P2 P1 P0 A3 A2 A1 A0

7 D6 D5 D4 D3 D2 D1 D0

D7 D6 D5 D4 D3 D2 D1 D0 …

…

Access Protection

All access pro tection bits are st ored on a s epar ate p age o f
the EEPROM that is not accessed using the normal
commands of an AT24C08 memory . See the “Access
Protection Page” s ecti on on page 5, f or m ore de tail on th is
information.

The RFID Access (RF) fields in the Access Protection Page
determines whether or not the corresponding block within
the memory can be read or written via the RFID interface. If
an illegal command is att empted, the command wi ll be
aborted. The MSB, if clear, prohibits all accesses from the
RFID port, and the LSB if clear prohibits writes from the
RFID port. The fields are stored in the EEPROM and
organized as follows:

RFID Access Fields (RF)

MSB LSB Function

0 0 No accesses permitted from RFID port
0 1 No accesses permitted from RFID port
1 0 Reads only from the RFID port
1 1 No restrictions for RFID accesses

The Protection Bits (PB) fields in the Access Protection
Page determine what type of accesses will be permitted via
the serial port for each of the blocks on the chip. If an illegal
access is attempte d, the comma nd will be NACK’ed. The
MSB, if clear, prohibits all accesses to the block, and the
LSB if clear prohibits writes. T he fields are stored in the
EEPROM and are organized as follows:

Protection Bits (PB)

MSB LSB Function

0 0 No accesses permitted in the blo ck
0 1 No accesses permitted in the blo ck
1 0 Read onl y, writes cause a NACK

11

The Tamper Write (TW) bits within the access protection
page control whether or not a write will be permitted into
the corresponding blo ck of mem or y when the Tamper Bit is
set. If the Tamper Bit is a 1 and the TW bit i s a 0, then
writes to that block from the RFID port are not permitted. In
all other cases, writes are permitted according to the RF
field value for that block. The value of this bit does not affect
accesses from the serial port.

Read/write - No access constraints for
data within this block

AT24RF08C

Accessed within the Access Protection P age is an
individual CMOS Sticky Bit (SB) for each of the 8 blocks on
the device. When the value of the sticky bit is 0, the
Protection Bits (PB) for th e corr es pon ding bl oc k may not be
changed via the software. These bits are all set to one
when power is initially applied or when the PROT pin is low.
These sticky bits may be written only to a 0 via th e serial
interface using the standard serial write operations.
Reading the sticky bits does not affect their state.

Because access permi ssions are set indiv idually for each
of the blocks, all reads via the serial port will onl y read
bytes within the block that was specified when the current
address was latched into the device (with a write
command). The block address bits (B
with the write command are ignored on a read command.

After the read of the last byte within a block, the internal
serial address wraps aroun d to point at the beginning of
that block. After the write of the last byte in a page, the
internal address is wrapped around to point to the
beginning of that page. If more than 16 bytes are sent to
the device with a write command, the data written to any
overlapping bytes will be corrupt ed.

If the WP pin is high, all write operations are prohibited
from the serial port, although write commands may be used
to set the address for a subsequent read command.

Block 0 Write Protection Bits

The AT24RF08C provides a mechanism to divi de block 0
into eight 128 -bit (16 byt e) pages tha t can be in dividual ly
protected again st writes from either port. Thes e eight writ e
protection (WP) bits are stored within a byte of the access
protection page and are organized such that the LSB
protects the first 128 bits and so on. If a bit in this byte is set
to a one and the PB
permitted on t he page correspon ding to the WP b it. If th e
WP bit is set to a 0 or the PB
then writes are not permitted in that page.

The Write Protection hierarchy for serial accesses is shown
on the following page. In thi s drawing th e bits wit hin the
boxes to the left of the arrows are the only thing that
determine whether or not the bit in the box to the right of
the arrow can be written. Read access control is not shown
in this diagram. Add ress es lis ted i n th is di agram ar e for th e
serial port assuming that the R/W bit in the command byte
is set to 0.

field is set to 11, then writes are

0

is any value other than 11,

0

or B1) that are sen t

2

3

For example, when SB1 is a 1, the PB1 field ca n be writte n
to any valu e b y t he s y ste m . W he n the PB 1 f i el d is 11, Block
1 can be written by the syste m. Note that the s tate of the
SB1 bit does not affect whether or not Block 1 can be
written.

Write Protection Flow

There is no individua l page Wr ite Protecti on for an y other
block other than bloc k 0 within the device. Wi thin the
remaining blocks on t he ch ip, acces s per missi ons a re con­trolled on a block basis ( PB or RF bits) or full chip basis
(WP pin) only.

EEPROM Tamper Latch

There is an additional EEPROM tamper latch that can be
set from the RFID port and reset from the serial por t of the
device. Resetting this bit from the serial port takes less
than 10 ms. Setting of this bit from the RFID side when
powered from L1/L2, takes about 7.9 ms but requires less
than 30 µA of current. See “RFID Command” on page 8.

4

AT24RF08C

Access to this ta mper bit from t he seri al int erfac e is vi a the
LSB of the tamper byte of th e acce ss pr otect ion page . See
“Access Protection Page” below. The bit can only be set to
0 via the serial port . Attempts to write it to a val ue of one
are ignored.

Access Protection Page

The serial port may be used to read and write the Access
Protection P age (APP) an d ID Pag e using dev ice access
codes of B8 and B9 (hex) instead of the normal value of A8
through AF (hex) th at are used to access the r est of the
EEPROM memory. The second byte of write commands
(the word addres s) sh ould be in the range of 00 thr ough 0 f
(hex) for the APP page and 10 through 1F (hex) for the ID
page. This coding is shown below.

Reads and writ es to th ese tw o pages may t ake plac e on a
single byte basis only. Multi-byte operations will be
NACK’ed.

As an example, the bit encoding for a single byte read an d
write command are shown below.

The AT24RF08C will acknowledge all device addresses of
B8 or B9 (hex). If the most s ignificant three bits of the w ord
address are not all 0 (indicating an address outside the
Access Protection and ID pages), the chip will NACK the
access.

Bytes 0 through 7 of the APP contain 8 identical sets of
access control fie lds (PBx, RFx, TWx and SBx) for e ach of
the eight blocks of mem ory on the chip, whi ch operate
according to the table listed in the Access P rotection sec­tion above. When t he s tick y bit i n on e o f the se by tes i s se t,
that byte can be wr itten by the system . Once a st icky bit is
reset (written to zero) by the software, the byte containing it
can no longer be modified by the so ftware until the next
power cycle. These bytes can always be read by the sys­tem.

Byte 8 contains another PB field (PB
an additional sticky bit (SB

bits controls read and write access to the la st 7 by tes

PB

AP

) as bit 7. The value of the

AP

(#9-15) of the APP and all 16 bytes of the ID page
according to the encoding listed in the “Access Protection”
section above. The value of the PB

) as bits 0 and 1 and

AP

bits can only be

AP

AT24RF08C

changed (via writes from the serial port) when SB
This byte can always be read by the system. Bits 0 through
6 of this byte are stored in EEPROM memory and do not
change when the power is cycled or the PROT pin changes
state.

Byte 9 contains the 8 block 0 write protection bits (WP) for
each page within block 0.

Byte 10 is the tamper byte, and the LSB of this byte ca n be
used to determine if the “set tamper” c ommand h ad been
executed from the RFID port. This bit can be reset in
software via the serial port by writing a 0 to it.

Byte 10 also contains the coil detection control. This
feature is intended to permit the system to determine if a
coil is connected to the pins. It works by driving a small
current through the coil pins and determining if there is a
low resistance between them. The coil resistance must be
less than R

for the coi l to be p roperly dete cted. To

COIL

enable this, the Detect Enable (DE) bit should be set to a 1.
After a delay of at least 200 µs, the Detect Coil (DC) bit is
then read and a “1” indicates that a coil is present.
Note that the RFID interface ma y not function properly
when the DE bit is set to a 1, and so the software should
ensure that it is always written to a 0 when the coil
detection sequence has completed. The DE bit is
automatically reset to a 0 upo n p o wer- up or when PROT is
held low, but is not timed out internally by the device.

When the DE bit is low, the value of the DC bit will default
to a high state. This doe s not indicate the presence of a
coil, as the state of the DC bit is onl y valid wh en the DE bi t
is high.

Bytes 11 through 14 are currently reserved and should no t
be used by the system. Byte 14 may not be written by the
device (via either interface) at any time.

is high.

AP

Access Protection Page Examples

For Write Operations:

1 0 1 1 1 0 0 0 0 0 0 A

For Read Operations:

1 0 1 1 1 0 0 1 D

4 A3 A2 A1 A0

7 D6 D5 D4 D3 D2 D1 D0

D7 D6 D5 D4 D3 D2 D1 D

0

5

Byte 15 contains dev ic e rev is ion information. It is se t at th e
wafer production facility and cannot be changed in the field,
so any write to this byte will be ignored. The least
significant three bits are used to s how the production
revision for the part. The next thr ee bit s are u se d to d enot e
the option set chosen and the most significant two bits

The memory map for the access protection page is shown
in the table below. In this table, an x means that the value is
a don’t care upon writing and that it is undefined upon
reading. The RF and PB fields are all two bits wide, and the
Device Revision field is 8 bits w ide . All other fields are one

bit wide.
describe the basi c funct iona lity of the dev ice. Th e val ue of
this byte is 01 001 001, or 49 (hex).

APP Memory Map

Address Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

0SB

0

1SB1TW
2SB2TW
3SB3TW
4SB4TW
5SB5TW
6SB6TW
7SB7TW

TW

0

1

2

3

4

5

6

7

RF
RF
RF
RF
RF
RF
RF
RF

0

1

2

3

4

5

6

7

xx PB
xx PB
xx PB
xx PB
xx PB
xx PB
xx PB

xx PB
8SBAPxxxxx PB
9 WP7 WP6 WP5 WP4 WP3 WP2 WP1 WP0

10 DE DC x x x x x Tamper
11 reserved
12 reserved
13 reserved
14 reserved
15 Device Revision

With the exception o f th e 9 st ic ky bits (SB) and the two c oil
detect bits (DE and DC), all bits within the Access
Protection Page are stored in EEP ROM memory. Their
state does not change if power is removed or when the
PROT pin is held low.

The following page of memory (acce ssed with A

4

= 1)
contains the ID field transmitted by the device from the
RFID port. Bytes within it are acce ssed via a device
address byte of B8 / B9 (write / read, hex) and a byte
address of 10 through 1F (hex). Rea di ng and writing to this
ID page is permitted when PB

is 11. The least significan t

AP

three bits of the firs t byte should vary to opti mize mult iple
tag performance.

The MSB of the last byte of the ID page is a lock bit that

is a 0, writes to this page from the RFID part are locked out
(prohibited). This bit does not affect operation from the
serial side, and can be read and written to eithe r state
normally from the serial port. The ID page can always be
read from the RFID port.

Please note that neither the RF fields nor the TW bits
protect the ID page against writes from the RFID port.
Unless the ID value is locked us ing the ID loc k bit, t he us er
can write to the ID page regardless of the state of any
access control bits.

Other than setting the tamper bit via the RF ID commands
or reading the ID field when so directed, there is no way for
the RFID port to directly read or write the access protection
page.

controls writes to the ID page fr om th e RFID port. If this bit

0

1

2

3

4

5

6

7

AP

6

AT24RF08C

Serial EEPROM Exceptions

In general, the two-wire serial interfa ce on the AT 24RF08 C
functions identicall y to the AT24C08. The followin g
exceptions exist, as noted elsewhere within this document.

• Pins 1, 2 and 3 have a different usage.

• Access to various blocks may be restricted via the

access protection circuitry.

• The two block address bits (B2 and B1) in the command

byte are ignored with all read commands. They are set
only via the write command.

• Multi-byte reads do not cross block boundaries, but

instead wrap to the beginning of the block.

• Operation of the serial bus at 400 kHz is not guaranteed.

• Maximum operating voltage is 5.5V, maximum operating

temperature is 85×C.

• The serial port will be reset whenever the PROT pin is

low.

• If a multi byte read is in progress when an RFID write

starts, all data will be read as all 1s.

• Under some circumstances, subsequent bytes within a

multi-byte read may have their data returned as all 1s to
the serial port if a read is simultaneously requested from
the RFID port.

• If more than 16 bytes are written to the EEPROM with a

page write, overlapping bytes will have their values
corrupted.

• If V

is 0V, the device draws current on the SDA, SCL,

CC

WP and PROT pins when they are brought above 0V.

RFID Port Operation

The AT24RF08C includes a powerful and flexible RFID
communications port that permits moving data into or out of
the device through a simpl e coil ant enna. Featur es includ e
automatic serial number transmission as well as
commands for explicit reads and writes to specified
locations within the EEPROM. Special capability has been
added to permit a tag to be individually identifie d and
selected when it is within the field at the same time as the
other tags.

The general strategy for implementing multiple tags within
the field is as follows:

Upon power-up, the tag wait s a random period of tim e and
then transmits, as a heade r, a fix ed pattern that o ccupies
four bit times. The valu e of each half- bit ti me is fixed at th e
pattern 01 11 11 10. (this is int erpreted as one hal f-bit tim e
with no modulation, 3-bit times of modulation and another
half-bit time of no modulation).

AT24RF08C

Within the follow ing li stening window , the tag m ust recei ve
an acknowledge pulse from the reader. See the “Listening
Window” section for restrictions on this transmission.

If the tag does not see an acknowledge pulse during the
specific time within the listening window, but se es an
acknowledge pulse or command is sued by the reader to
another tag, it goes into an infinite listening window until the
other tag is complete with its transaction.

If the tag does not see an acknowle dge pulse or com mand
from the reader at any time, i t will wait for a rando m lengt h
of time before transmitting its four bit header again.

If it does receive this acknowledge pulse during the specific
time, then it will continuously tra nsmit its complete ID
(defined below) with a three bi t listenin g window b etween
frames, until a command is received from the reader.

After the ID has been properly received by the reader, the
tag will expect to receive a c ommand from the reader
during the three bit listening window between ID frames.
One possible com mand is to set the
device to remain idle until the next power down or global
command. Remaining tag s will then follow the same
procedure until each has its

QUIET bit set.

ID Configuration

After the chip ’s head er field has b een ackno wledged, th e
chip will transmit as its ID number, the first 12 EEPROM
bytes in the ID page, starting with byte 0. This transmission
will start 1664 ms after the end of the header transmission.
See “RFID Acknowledge Timing” on page 16.

This ID transmissio n will be preceded b y a sin gle start bi t
that has a logical val ue of 1, and termina ted by a single
stop bit that has a logical value of ‘0’. These start and stop
bits bracket each page or block of data transmitted by the
device as a result of a read or write command.

After transmission of the ID frame, the device will delay
transmission during a 3 bit listening window to listen for a
command to be initiated before repeating the ID
transmission a gain. Comman ds sen t t o selec ted t ags m ust
be initiated during the t
window, as per the “Listening Window” section on page 9.

If a write is taking place to the EEPROM from the serial
port, the device will transmit to the reader a logical 0 in
place of the ID value until that write completes. If a write
from the serial port has started before the command is
issued by the reader, then the com mand will be abo rted
and the 4 bit header sent. If a serial port writ e starts after a
read command has commenced, then a 0 will be
transmitted to the reader d uring the tim e th at th e E EP ROM
is busy with the write. In some cases , reads fr om the s erial
port will also cause data to temporarily be read as 0’s.

interval within this listening

CDM1

QUIET bit, causing the

7