Rainbow Electronics MAX66140 User Manual

General Description

The MAX66140 combines 1024 bits of user EEPROM with secure hash algorithm (SHA-1) challenge-andresponse authentication (ISO/IEC 10118-3 SHA-1), a 64-bit unique identifier (UID), one 64-bit secret, and a

13.56MHz ISO 15693 RF interface in a single chip. The memory is organized as 16 blocks of 8 bytes plus three more blocks—one for the secret and two for data and control registers. Except for the secret, each block has a user-readable write-cycle counter. Four adjacent user EEPROM blocks form a memory page (pages 0 to 3). The integrated SHA-1 engine provides a Message Authentication Code (MAC) using data from the EEPROM of the device and the 64-bit secret to guarantee secure, symmetric authentication for both reading and writing to the device. Memory protection features are write protection and EPROM emulation, which the user can set for each individual memory page. Page 3 can also be read protected for enhanced authentication strength. The MAX66140 supports all ISO 15693defined data rates, modulation indices, subcarrier modes, the selected state, application family identifier (AFI), data storage format identifier (DSFID), and the Option_flag bit for read operations. Memory write access (except for AFI, DSFID, and the corresponding lock bytes) is accomplished through custom commands using a write buffer with readback and copy-tomemory function.

Applications

Driver Identification (Fleet Application)

Access Control

eCash

Asset Tracking

Features

♦ Fully Compliant with ISO 15693 and ISO 18000-3

Mode 1 Standard

♦ 13.56MHz ±7kHz Carrier Frequency

♦ 1024-Bit Secure User EEPROM with Block Lock

Feature, Write-Cycle Counter, and Optional EPROM-Emulation Mode

♦ 64-Bit UID

♦ 512-Bit SHA-1 Engine to Compute 160-Bit MAC

and to Generate Secrets

♦ Mutual Authentication: Data Read from Device is

Verified and Authenticated by the Host with Knowledge of the 64-Bit Secret

♦ Read and Write (64-Bit Block)

♦ Supports AFI and DSFID Function

♦ 10ms Programming Time

♦ Write: 10% or 100% ASK Modulation Using 1/4

(26kbps) or 1/256 (1.6kbps) Pulse Position Coding

♦ Read: Load Modulation Using Manchester Coding

with 423kHz and 484kHz Subcarrier in Low (6.6kbps) or High (26kbps) Data-Rate Mode

♦ 200,000 Write/Erase Cycles (Minimum)

♦ 40-Year Data Retention (Minimum)

♦ Read Compatible with Existing 1Kb ISO 15693

Products on the Market

MAX66140

ISO 15693-Compliant Secure Memory

________________________________________________________________

Maxim Integrated Products

Typical Operating Circuit

Rev 1; 1/11

For pricing, delivery, and ordering information, please contact Maxim Direct at 1-888-629-4642, or visit Maxim’s website at www.maxim-ic.com.

ABRIDGED DATA SHEET

Mechanical Drawings appear at end of data sheet.

EVALUATION KIT

AVAILABLE

Ordering Information

Denotes a lead(Pb)-free/RoHS-compliant package.

PART TEMP RANGE PIN-PACKAGE

MAX66140E-000AA+ -25°C to +50°C ISO Card

MAX66140K-000AA+ -25°C to +50°C Key Fob

13.56MHz READER

TRANSMITTER

TX_OUT

RX_IN

MAGNETIC COUPLING

ANTENNA

MAX66140

IC LOAD

SWITCHED

LOAD

MAX66140

ISO 15693-Compliant Secure Memory

2 _______________________________________________________________________________________

ABRIDGED DATA SHEET

ABSOLUTE MAXIMUM RATINGS

ELECTRICAL CHARACTERISTICS

(TA= -25°C to +50°C, unless otherwise noted.) (Note 1)

Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. These are stress ratings only, and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of the specifications is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability.

Note 1: Guaranteed by simulation, not production tested. Note 2: Write-cycle endurance is degraded as T

increases. Not 100% production tested; guaranteed by reliability monitor sampling.

Note 3: Guaranteed by 100% production test at elevated temperature for a shorter time; equivalence of this production test to data

sheet limit at operating temperature range is established by reliability testing.

Note 4: System requirement. Note 5: Production tested at 13.56MHz only. Note 6: Measured from the time at which the incident field is present with strength greater than or equal to H

(MIN)

to the time at which the MAX66140’s internal power-on reset signal is deasserted and the device is ready to receive a command frame. Not characterized or production tested; guaranteed by simulation only.

Maximum Incident Magnetic Field Strength ..........141.5dBµA/m

Operating Temperature Range ...........................-25°C to +50°C

Relative Humidity ..............................................(Water Resistant)

Storage Temperature Range ...............................-25°C to +50°C

PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS

SHA-1 ENGINE

SHA-1 Computation Time t

EEPROM

Programm ing Time t

Endurance N

Data Retention t

RF INTERFACE

Carrier Frequency f

Activation Field Strength (Note 1)

Write Field Strength (Note 1) H

Maximum Field Strength H

Power-Up Time t

PROG

CSHA

CYCLE

RET

MIN

MAX

POR

(Note 1) Refer to the full data sheet. ms

(Note 1) 9 10 ms

At +25°C (Note 2) 200,000 Cycle s

(Note 3) 40 Years

(Notes 4, 5) 13.553 13.560 13.567 MHz

At +25°C, MAX66140E 110.5

At +25°C, MAX66140K 122.0

At +25°C, MAX66140E 110.7

At +25°C, MAX66140K 122.4

At +25°C (Note 1) 137.5 dBμA/m

(Notes 1, 6) 1.0 ms

dBμA/m

Detailed Description

The MAX66140 combines 1024 bits of user EEPROM, 128 bits of user and control registers, a 64-bit UID, one 64-bit secret, a 512-bit SHA-1 engine, and a 13.56MHz ISO 15693 RF interface in a single chip. The memory is organized as 19 blocks of 8 bytes each. Except for the secret, each block has a user-readable write-cycle counter. Four adjacent user EEPROM blocks form a memory page (pages 0 to 3). Memory protection features include write protection and EPROM emulation, which the user can set for each individual memory page. Page 3 can also be read protected for enhanced authentication strength. The MAX66140 is accessed through ISO 15693-compliant memory and control function commands. The data rate can be as high as

26.69kbps. The MAX66140 supports AFI and DSFID. Applications of the MAX66140 include driver identification (fleet application), access control, electronic cash, and asset tracking.

Overview

Figure 1 shows the relationships between the major control and memory sections of the MAX66140. The device has six main data components: 1) 64-bit UID, 2) 64-bit read/write buffer, 3) four 256-bit pages of user EEPROM,

4) two 8-byte blocks of user and control registers, 5) 64bit secret’s memory, and 6) a 512-bit SHA-1 engine. Figure 2 shows the applicable ISO 15693 commands and their purpose. The network function commands

allow the master to identify all slaves in its range and to change their state, e.g., to select one for further communication. The protocol required for these network function commands is described in the

Network Function

Commands

section. The memory and control functions access the memory of the MAX66140 for reading and writing. The protocol for these memory and control function commands is described in the

Memory and Control

Function Commands

section. All data is read and written least significant bit (LSb) first, starting with the least significant byte (LSB).

Parasite Power

As a wireless device, the MAX66140 is not connected to any power source. It gets the energy for operation from the surrounding RF field, which needs to have a minimum strength as specified in the

Electrical

Characteristics

table.

Unique Identification Number (UID)

Each MAX66140 contains a factory-programmed and locked identification number that is 64 bits long (Figure 3). The lower 36 bits are the serial number of the chip. The next 8 bits store the device feature code, which is 03h. Bits 45 to 48 are 0h. The code in bit locations 49 to 56 identifies the chip manufacturer, according to ISO/IEC 7816-6/AM1. This code is 2Bh for Maxim. The code in the upper 8 bits is E0h. The UID is read accessible through the Inventory and Get System Information commands.

MAX66140

Figure 1. Block Diagram

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 3

ABRIDGED DATA SHEET

FRONT-

END

DATA

MODULATION

INTERNALSUPPLY

VOLTAGE

REGULATOR

ISO 15693

FRAME

FORMATTING

ERROR

DETECTION

AND

MEMORY AND

FUNCTION

CONTROL

READ/WRITE BUFFER

BLOCK

UID

SHA-1

ENGINE

SECRET

USER

EEPROM

MAX66140

Detailed Memory Description

ISO 15693-Compliant Secure Memory

4 _______________________________________________________________________________________

ABRIDGED DATA SHEET

Figure 2. ISO 15693 Commands Overview

MSB LSB

64 57 56 49 48 45 44 37 36 1

E0h 2Bh 0h Feature Code (03h) 36-Bit IC Serial Number

Figure 3. 64-Bit UID

Refer to the full data sheet for this information.

Refer to the full data sheet.

MAX66140

COMMAND TYPE:

NETWORK

FUNCTION COMMANDS

AVAILABLE COMMANDS: DATA FIELD AFFECTED:

INVENTORY STAY QUIET SELECT RESET TO READY

UID, AFI, DSFID, ADMINISTRATIVE DATA UID UID UID

GET SYSTEM INFORMATION UID, AFI, DSFID, CONSTANTS

MEMORY AND CONTROL

FUNCTION COMMANDS

ISO 15693 Communication

Concept

The communication between master and MAX66140 (slave) is based on the exchange of data packets. The master initiates every transaction; only one side (master or slaves) transmits information at any time. Each data packet begins with a start-of-frame (SOF) pattern and ends with an end-of-frame (EOF) pattern. A data packet with at least 3 bytes between SOF and EOF is called a

frame (Figure 5). The last 2 bytes of an ISO 15693 frame are an inverted 16-bit CRC of the preceding data generated according to the CRC-16-CCITT polynomial. This CRC is transmitted with the LSB first. For more details on the CRC-16-CCITT, refer to ISO 15693 Part 3, Annex C.

For transmission, the frame information is modulated on a carrier frequency, which in the case of ISO 15693 is

13.56MHz. The subsequent paragraphs are a concise description of the required modulation and coding. For

MAX66140

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 7

Figure 5. ISO 15693 Frame Format

ABRIDGED DATA SHEET

SOF 1 OR MORE DATA BYTES CRC (LSB) CRC (MSB) EOF

TIME

MAX66140

full details including graphics of the data coding schemes and SOF/EOF timing, refer to ISO 15693-2, Sections 7.2, 7.3, and 8.

The path from master to slave uses amplitude modula- tion (Figure 6); the modulation index can be either in the range of 10% to 30% or 100% (ISO 15693-2, Section 7.1). The standard defines two pulse-position coding schemes that must be supported by a compliant device. Scheme A uses the “1 out of 256” method (Figure 7), where the transmission of 1 byte takes

4.833ms, equivalent to a data rate of 1655 bits/s. The location of a modulation notch during the 4.833ms conveys the value of the byte. Scheme B uses the “1 out of 4” method (Figure 8), where the transmission of 2 bits takes 75.52µs, equivalent to a data rate of 26,484 bits/s. The location of a modulation notch during the

75.52µs conveys the value of the 2 bits. A byte is transmitted as a concatenation of four 2-bit transmissions, with the least significant 2 bits of the byte being transmitted first. The transmission of the SOF pattern takes the same time as transmitting 2 bits in Scheme B. The SOF pattern has two modulation notches, making it distinct from any 2-bit pattern. The position of the second notch tells whether the frame uses the “1 out of 256” or “1 out of 4” coding scheme (Figures 9 and 10, respectively). The transmission of the EOF pattern takes

37.76µs; the EOF is the same for both coding schemes and has one modulation notch (Figure 11).

The path from slave to master uses one or two subcar- riers, as specified by the Subcarrier_flag bit in the request data packet. The standard defines two data rates for the response, low (approximately 6,600 bits/s) and high (approximately 26,500 bits/s). The Data_rate_flag bit in the request data packet specifies the response data rate. The data rate varies slightly depending on the use of one or two subcarriers. The LSb is transmitted first. A compliant device must support both subcarrier modes and data rates.

In the single subcarrier case, the subcarrier frequency is 423.75kHz. One bit is transmitted in 37.76µs (high data rate) or 151µs (low data rate). The modulation is the on/off key. For a logic 0, the subcarrier is on during the first half of the bit transmission time and off for the second half. For a logic 1, the subcarrier is off during the first half of the bit transmission time and on for the second half. See Figure 12 for more details.

In the two subcarrier cases, the subcarrier frequencies are 423.75kHz and 484.28kHz. The bit duration is the same as in the single subcarrier case. The modulation is equivalent to binary FM. For a logic 0, the lower subcarrier is on during the first half of the bit transmission time, switching to the higher subcarrier for the second half. For a logic 1, the higher subcarrier is on during the

ISO 15693-Compliant Secure Memory

8 _______________________________________________________________________________________

ABRIDGED DATA SHEET

Figure 6. Downlink Modulation (e.g., Approximately 100% Amplitude Modulation)

Figure 7. Downlink Data Coding (Case “1 Out of 256”)

CARRIER

AMPLITUDE

100%

PULSE-

MODULATED

CARRIER

01234 . . . . . 2

~ 9.44μs

~ 18.88μs

....... ........2

2 5

~ 4.833ms

.....

2 5 2

MAX66140

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 9

Figure 9. Downlink SOF for “1 Out of 256” Coding (Carrier Not Shown)

Figure 8. Downlink Data Coding (Case “1 Out of 4,” Carrier Not Shown)

first half of the bit transmission time, switching to the lower subcarrier for the second half. See Figure 13 for details. The transmission of the SOF pattern takes the same time as transmitting 4 bits (approximately 151µs at a high data rate or approximately 604µs at a low data

rate). The SOF is distinct from any 4-bit data sequence. The EOF pattern is equivalent to a SOF being transmitted backwards. The exact duration of the SOF and EOF varies slightly depending on the use of one or two subcarriers (Figures 14 and 15, respectively).

ABRIDGED DATA SHEET

PULSE POSITION "00"

~ 9.44μs ~ 9.44μs

PULSE POSITION "01" (1 = LSB)

~ 28.32μs

PULSE POSITION "10" (0 = LSB)

~ 9.44μs

~ 75.52μs

~ 47.20μs

~ 75.52μs

PULSE POSITION "11"

~ 66.08μs

~ 75.52μs

~ 9.44μs

~ 37.76μs ~ 37.76μs

~ 9.44μs

+ 14 hidden pages