General Description
The MAX66140 combines 1024 bits of user EEPROM
with secure hash algorithm (SHA-1) challenge-andresponse authentication (ISO/IEC 10118-3 SHA-1), a
64-bit unique identifier (UID), one 64-bit secret, and a
13.56MHz ISO 15693 RF interface in a single chip. The
memory is organized as 16 blocks of 8 bytes plus three
more blocks—one for the secret and two for data and
control registers. Except for the secret, each block has
a user-readable write-cycle counter. Four adjacent user
EEPROM blocks form a memory page (pages 0 to 3).
The integrated SHA-1 engine provides a Message
Authentication Code (MAC) using data from the
EEPROM of the device and the 64-bit secret to guarantee secure, symmetric authentication for both reading
and writing to the device. Memory protection features
are write protection and EPROM emulation, which the
user can set for each individual memory page. Page 3
can also be read protected for enhanced authentication
strength. The MAX66140 supports all ISO 15693defined data rates, modulation indices, subcarrier
modes, the selected state, application family identifier
(AFI), data storage format identifier (DSFID), and the
Option_flag bit for read operations. Memory write
access (except for AFI, DSFID, and the corresponding
lock bytes) is accomplished through custom commands using a write buffer with readback and copy-tomemory function.
Applications
Driver Identification (Fleet Application)
Access Control
eCash
Asset Tracking
Features
♦ Fully Compliant with ISO 15693 and ISO 18000-3
Mode 1 Standard
♦ 13.56MHz ±7kHz Carrier Frequency
♦ 1024-Bit Secure User EEPROM with Block Lock
Feature, Write-Cycle Counter, and Optional
EPROM-Emulation Mode
♦ 64-Bit UID
♦ 512-Bit SHA-1 Engine to Compute 160-Bit MAC
and to Generate Secrets
♦ Mutual Authentication: Data Read from Device is
Verified and Authenticated by the Host with
Knowledge of the 64-Bit Secret
♦ Read and Write (64-Bit Block)
♦ Supports AFI and DSFID Function
♦ 10ms Programming Time
♦ Write: 10% or 100% ASK Modulation Using 1/4
(26kbps) or 1/256 (1.6kbps) Pulse Position Coding
♦ Read: Load Modulation Using Manchester Coding
with 423kHz and 484kHz Subcarrier in Low
(6.6kbps) or High (26kbps) Data-Rate Mode
♦ 200,000 Write/Erase Cycles (Minimum)
♦ 40-Year Data Retention (Minimum)
♦ Read Compatible with Existing 1Kb ISO 15693
Products on the Market
MAX66140
ISO 15693-Compliant Secure Memory
________________________________________________________________
Maxim Integrated Products
1
Typical Operating Circuit
Rev 1; 1/11
For pricing, delivery, and ordering information, please contact Maxim Direct at 1-888-629-4642,
or visit Maxim’s website at www.maxim-ic.com.
ABRIDGED DATA SHEET
Mechanical Drawings appear at end of data sheet.
EVALUATION KIT
AVAILABLE
Ordering Information
+
Denotes a lead(Pb)-free/RoHS-compliant package.
PART TEMP RANGE PIN-PACKAGE
MAX66140E-000AA+ -25°C to +50°C ISO Card
MAX66140K-000AA+ -25°C to +50°C Key Fob
13.56MHz READER
TRANSMITTER
TX_OUT
RX_IN
MAGNETIC
COUPLING
ANTENNA
MAX66140
IC LOAD
SWITCHED
LOAD
MAX66140
ISO 15693-Compliant Secure Memory
2 _______________________________________________________________________________________
ABRIDGED DATA SHEET
ABSOLUTE MAXIMUM RATINGS
ELECTRICAL CHARACTERISTICS
(TA= -25°C to +50°C, unless otherwise noted.) (Note 1)
Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. These are stress ratings only, and functional
operation of the device at these or any other conditions beyond those indicated in the operational sections of the specifications is not implied. Exposure to
absolute maximum rating conditions for extended periods may affect device reliability.
Note 1: Guaranteed by simulation, not production tested.
Note 2: Write-cycle endurance is degraded as T
A
increases. Not 100% production tested; guaranteed by reliability monitor sampling.
Note 3: Guaranteed by 100% production test at elevated temperature for a shorter time; equivalence of this production test to data
sheet limit at operating temperature range is established by reliability testing.
Note 4: System requirement.
Note 5: Production tested at 13.56MHz only.
Note 6: Measured from the time at which the incident field is present with strength greater than or equal to H
(MIN)
to the time at
which the MAX66140’s internal power-on reset signal is deasserted and the device is ready to receive a command frame.
Not characterized or production tested; guaranteed by simulation only.
Maximum Incident Magnetic Field Strength ..........141.5dBµA/m
Operating Temperature Range ...........................-25°C to +50°C
Relative Humidity ..............................................(Water Resistant)
Storage Temperature Range ...............................-25°C to +50°C
PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS
SHA-1 ENGINE
SHA-1 Computation Time t
EEPROM
Programm ing Time t
Endurance N
Data Retention t
RF INTERFACE
Carrier Frequency f
Activation Field Strength
(Note 1)
Write Field Strength (Note 1) H
Maximum Field Strength H
Power-Up Time t
PROG
H
CSHA
CYCLE
RET
C
MIN
WR
MAX
POR
(Note 1) Refer to the full data sheet. ms
(Note 1) 9 10 ms
At +25°C (Note 2) 200,000 Cycle s
(Note 3) 40 Years
(Notes 4, 5) 13.553 13.560 13.567 MHz
At +25°C, MAX66140E 110.5
At +25°C, MAX66140K 122.0
At +25°C, MAX66140E 110.7
At +25°C, MAX66140K 122.4
At +25°C (Note 1) 137.5 dBμA/m
(Notes 1, 6) 1.0 ms
dBμA/m
dBμA/m
Detailed Description
The MAX66140 combines 1024 bits of user EEPROM,
128 bits of user and control registers, a 64-bit UID, one
64-bit secret, a 512-bit SHA-1 engine, and a 13.56MHz
ISO 15693 RF interface in a single chip. The memory is
organized as 19 blocks of 8 bytes each. Except for the
secret, each block has a user-readable write-cycle
counter. Four adjacent user EEPROM blocks form a
memory page (pages 0 to 3). Memory protection features include write protection and EPROM emulation,
which the user can set for each individual memory
page. Page 3 can also be read protected for enhanced
authentication strength. The MAX66140 is accessed
through ISO 15693-compliant memory and control function commands. The data rate can be as high as
26.69kbps. The MAX66140 supports AFI and DSFID.
Applications of the MAX66140 include driver identification (fleet application), access control, electronic cash,
and asset tracking.
Overview
Figure 1 shows the relationships between the major control and memory sections of the MAX66140. The device
has six main data components: 1) 64-bit UID, 2) 64-bit
read/write buffer, 3) four 256-bit pages of user EEPROM,
4) two 8-byte blocks of user and control registers, 5) 64bit secret’s memory, and 6) a 512-bit SHA-1 engine.
Figure 2 shows the applicable ISO 15693 commands
and their purpose. The network function commands
allow the master to identify all slaves in its range and to
change their state, e.g., to select one for further communication. The protocol required for these network function commands is described in the
Network Function
Commands
section. The memory and control functions
access the memory of the MAX66140 for reading and
writing. The protocol for these memory and control function commands is described in the
Memory and Control
Function Commands
section. All data is read and written least significant bit (LSb) first, starting with the least
significant byte (LSB).
Parasite Power
As a wireless device, the MAX66140 is not connected
to any power source. It gets the energy for operation
from the surrounding RF field, which needs to have a
minimum strength as specified in the
Electrical
Characteristics
table.
Unique Identification Number (UID)
Each MAX66140 contains a factory-programmed and
locked identification number that is 64 bits long
(Figure 3). The lower 36 bits are the serial number of the
chip. The next 8 bits store the device feature code, which
is 03h. Bits 45 to 48 are 0h. The code in bit locations 49 to
56 identifies the chip manufacturer, according to ISO/IEC
7816-6/AM1. This code is 2Bh for Maxim. The code in the
upper 8 bits is E0h. The UID is read accessible through
the Inventory and Get System Information commands.
MAX66140
Figure 1. Block Diagram
ISO 15693-Compliant Secure Memory
_______________________________________________________________________________________ 3
ABRIDGED DATA SHEET
RF
FRONT-
END
DATA
f
c
MODULATION
INTERNALSUPPLY
VOLTAGE
REGULATOR
ISO 15693
FRAME
FORMATTING
ERROR
DETECTION
AND
MEMORY AND
FUNCTION
CONTROL
READ/WRITE BUFFER
REGISTER
BLOCK
UID
SHA-1
ENGINE
SECRET
USER
EEPROM
MAX66140
Detailed Memory Description
ISO 15693-Compliant Secure Memory
4 _______________________________________________________________________________________
ABRIDGED DATA SHEET
Figure 2. ISO 15693 Commands Overview
MSB LSB
64 57 56 49 48 45 44 37 36 1
E0h 2Bh 0h Feature Code (03h) 36-Bit IC Serial Number
Figure 3. 64-Bit UID
Refer to the full data sheet for this information.
Refer to the full data sheet.
MAX66140
COMMAND TYPE:
NETWORK
FUNCTION COMMANDS
AVAILABLE COMMANDS: DATA FIELD AFFECTED:
INVENTORY
STAY QUIET
SELECT
RESET TO READY
UID, AFI, DSFID, ADMINISTRATIVE DATA
UID
UID
UID
GET SYSTEM INFORMATION UID, AFI, DSFID, CONSTANTS
MEMORY AND CONTROL
FUNCTION COMMANDS
ISO 15693 Communication
Concept
The communication between master and MAX66140
(slave) is based on the exchange of data packets. The
master initiates every transaction; only one side (master
or slaves) transmits information at any time. Each data
packet begins with a start-of-frame (SOF) pattern and
ends with an end-of-frame (EOF) pattern. A data packet
with at least 3 bytes between SOF and EOF is called a
frame (Figure 5). The last 2 bytes of an ISO 15693
frame are an inverted 16-bit CRC of the preceding data
generated according to the CRC-16-CCITT polynomial.
This CRC is transmitted with the LSB first. For more
details on the CRC-16-CCITT, refer to ISO 15693 Part 3,
Annex C.
For transmission, the frame information is modulated on
a carrier frequency, which in the case of ISO 15693 is
13.56MHz. The subsequent paragraphs are a concise
description of the required modulation and coding. For
MAX66140
ISO 15693-Compliant Secure Memory
_______________________________________________________________________________________ 7
Figure 5. ISO 15693 Frame Format
ABRIDGED DATA SHEET
SOF 1 OR MORE DATA BYTES CRC (LSB) CRC (MSB) EOF
TIME
MAX66140
full details including graphics of the data coding
schemes and SOF/EOF timing, refer to ISO 15693-2,
Sections 7.2, 7.3, and 8.
The path from master to slave uses amplitude modula-
tion (Figure 6); the modulation index can be either in
the range of 10% to 30% or 100% (ISO 15693-2,
Section 7.1). The standard defines two pulse-position
coding schemes that must be supported by a compliant device. Scheme A uses the “1 out of 256” method
(Figure 7), where the transmission of 1 byte takes
4.833ms, equivalent to a data rate of 1655 bits/s. The
location of a modulation notch during the 4.833ms conveys the value of the byte. Scheme B uses the “1 out
of 4” method (Figure 8), where the transmission of 2
bits takes 75.52µs, equivalent to a data rate of 26,484
bits/s. The location of a modulation notch during the
75.52µs conveys the value of the 2 bits. A byte is transmitted as a concatenation of four 2-bit transmissions,
with the least significant 2 bits of the byte being transmitted first. The transmission of the SOF pattern takes
the same time as transmitting 2 bits in Scheme B. The
SOF pattern has two modulation notches, making it distinct from any 2-bit pattern. The position of the second
notch tells whether the frame uses the “1 out of 256” or
“1 out of 4” coding scheme (Figures 9 and 10, respectively). The transmission of the EOF pattern takes
37.76µs; the EOF is the same for both coding schemes
and has one modulation notch (Figure 11).
The path from slave to master uses one or two subcar-
riers, as specified by the Subcarrier_flag bit in the
request data packet. The standard defines two data
rates for the response, low (approximately 6,600 bits/s)
and high (approximately 26,500 bits/s). The
Data_rate_flag bit in the request data packet specifies
the response data rate. The data rate varies slightly
depending on the use of one or two subcarriers. The
LSb is transmitted first. A compliant device must support both subcarrier modes and data rates.
In the single subcarrier case, the subcarrier frequency
is 423.75kHz. One bit is transmitted in 37.76µs (high
data rate) or 151µs (low data rate). The modulation is
the on/off key. For a logic 0, the subcarrier is on during
the first half of the bit transmission time and off for the
second half. For a logic 1, the subcarrier is off during
the first half of the bit transmission time and on for the
second half. See Figure 12 for more details.
In the two subcarrier cases, the subcarrier frequencies
are 423.75kHz and 484.28kHz. The bit duration is the
same as in the single subcarrier case. The modulation
is equivalent to binary FM. For a logic 0, the lower subcarrier is on during the first half of the bit transmission
time, switching to the higher subcarrier for the second
half. For a logic 1, the higher subcarrier is on during the
ISO 15693-Compliant Secure Memory
8 _______________________________________________________________________________________
ABRIDGED DATA SHEET
Figure 6. Downlink Modulation (e.g., Approximately 100%
Amplitude Modulation)
Figure 7. Downlink Data Coding (Case “1 Out of 256”)
CARRIER
AMPLITUDE
100%
t
PULSE-
MODULATED
CARRIER
01234 . . . . . 2
~ 9.44μs
~ 18.88μs
....... ........2
2
5
~ 4.833ms
.....
2
2
5
2
2
5
5
5
3
4
5
MAX66140
ISO 15693-Compliant Secure Memory
_______________________________________________________________________________________ 9
Figure 9. Downlink SOF for “1 Out of 256” Coding (Carrier Not Shown)
Figure 8. Downlink Data Coding (Case “1 Out of 4,” Carrier Not Shown)
first half of the bit transmission time, switching to the
lower subcarrier for the second half. See Figure 13 for
details. The transmission of the SOF pattern takes the
same time as transmitting 4 bits (approximately 151µs
at a high data rate or approximately 604µs at a low data
rate). The SOF is distinct from any 4-bit data sequence.
The EOF pattern is equivalent to a SOF being transmitted backwards. The exact duration of the SOF and EOF
varies slightly depending on the use of one or two subcarriers (Figures 14 and 15, respectively).
ABRIDGED DATA SHEET
PULSE POSITION "00"
~ 9.44μs ~ 9.44μs
PULSE POSITION "01" (1 = LSB)
~ 28.32μs
PULSE POSITION "10" (0 = LSB)
~ 9.44μs
~ 75.52μs
~ 75.52μs
~ 47.20μs
~ 75.52μs
PULSE POSITION "11"
~ 66.08μs
~ 75.52μs
~ 9.44μs
~ 37.76μs ~ 37.76μs
~ 9.44μs
~ 9.44μs
~ 9.44μs
MAX66140
ISO 15693-Compliant Secure Memory
10 ______________________________________________________________________________________
ABRIDGED DATA SHEET
Figure 10. Downlink SOF for “1 Out of 4” Coding (Carrier Not Shown)
Figure 11. Downlink EOF (Identical for Both Coding Schemes, Carrier Not Shown)
Figure 12. Uplink Coding, Single Subcarrier Case (High Data-Rate Timing)
~ 9.44μs
~ 37.76μs ~ 37.76μs
~ 9.44μs
~ 37.76μs
423.75kHz, ~ 18.88μs ~ 18.88μs
~ 9.44μs~ 9.44μs
~ 9.44μs
TRANSMITTING A ZERO
~ 37.76μs
TRANSMITTING A ONE
423.75kHz, ~ 18.88μs~ 18.88μs
~ 37.76μs
MAX66140
Figure 13. Uplink Coding, Two Subcarriers Case (High Data-Rate Timing)
Figure 14. Uplink SOF, Single Subcarrier Case (High Data-Rate Timing)
Figure 15. Uplink SOF, Two Subcarriers Case (High Data-Rate Timing)
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 11
ABRIDGED DATA SHEET
484.28kHz, ~ 18.58μs423.75kHz, ~ 18.88μs
~ 37.46μs
484.28kHz, ~ 18.58μs 423.75kHz, ~ 18.88μs
~ 37.46μs
423.75kHz 423.75kHz
~ 56.64μs ~ 56.64μs ~ 37.76μs
TRANSMITTING A ZERO
TRANSMITTING A ONE
~ 55.75μs ~ 56.64μs ~ 37.46μs
423.75kHz 423.75kHz484.28kHz484.28kHz
MAX66140
ISO 15693-Compliant Secure Memory
12 ______________________________________________________________________________________
ABRIDGED DATA SHEET
ISO 15693 Slave States and
Address Modes
Initially, the master has no information whether there are
any RF devices in the field of its antenna. The master
learns the UIDs of the slaves in its field from the
responses to the Inventory command, which does not
use the Address_flag and the Select_flag bits. The state
transitions are controlled by network function commands. Figure 16 shows details.
ISO 15693 defines four states in which a slave can be
plus three address modes. The states are power-off,
ready, quiet, and selected. The address modes are
nonaddressed, addressed, and selected. The
addressed mode requires that the master include the
slave’s UID in the request, which increases the size of
the requests by 8 bytes. Table 5 shows which address
mode is applicable depending on the slave’s state and
how to set the Address_flag and the Select_flag bits for
each address mode.
ISO 15693 States and Transitions
Power-Off State
This state applies if the slave is outside the master’s RF
field. A slave transitions to the power-off state when
leaving the power-delivering RF field. When entering
the RF field, the slave automatically transitions to the
ready state.
Ready State
In this state, a slave has enough power to perform any
of its functions. The purpose of the ready state is to
have the slave population ready to process the inventory command as well as other commands sent in the
addressed or nonaddressed mode. A slave can exit the
ready state and transition to the quiet or the selected
state upon receiving the Stay Quiet or Select command
sent in the addressed mode.
Quiet State
In this state, a slave has enough power to perform any
of its functions. The purpose of the quiet state is to
silence slaves that the master does not want to communicate with. Only commands sent with the addressed
mode are accepted and processed. This way the master can use the nonaddressed mode for communication
with remaining slaves in the ready state, which minimizes the size of the request data packets. As long as
no additional slaves arrive in the RF field, it is safe for
the master to continue communicating in the nonaddressed mode. A slave can exit the quiet state and
transition to the ready or the selected state upon receiving the Reset to Ready or Select command sent in the
addressed mode.
Selected State
In this state, a slave has enough power to perform any
of its functions. The purpose of the selected state is to
isolate the slave that the master wants to communicate
with. Commands are accepted and processed regardless of the address mode in which they are sent, including the Inventory command. With multiple slaves in the
RF field, the master can put one slave in the selected
state and leave all the others in the ready state. This
method requires less communication than using the
quiet state to single out the slave for communication.
For a slave in the selected state, the master can use the
selected mode, which keeps the request data packets
as short as with the nonaddressed mode. A new slave
entering the RF field cannot disturb the communication,
since it stays in the ready state. A slave can exit the
Table 5. Slave States and Applicable Address Modes
ADDRESS MODES
NONADDRESSED MODE
SLAVE STATES
Power-Off (Inactiv e) (Inactive) (Inacti ve)
Ready Yes Yes No
Quiet No Yes No
Selected Yes Yes Yes
(Address_flag = 0;
Select_flag = 0)
ADDRESS ED MODE
(Address_flag = 1;
Select_flag = 0)
SELECTED MODE
(Address_flag = 0;
Select_flag = 1)
selected state and transition to the ready or the quiet
state upon receiving the Reset to Ready command sent
in any address mode or the Stay Quiet command sent
in the addressed mode. A slave also transitions from
selected to ready upon receiving a Select command if
the UID in the request is different from the slave’s own
UID. In this case the master’s intention is to transition
another slave with the matching UID to the selected
state. If the slave already in the selected state does not
recognize the command, e.g., due to a bit error, two
slaves could be in the selected state. To prevent this
from happening, the master should use the Reset to
Ready or the Stay Quiet command to transition a slave
out of the selected state.
MAX66140
Figure 16. ISO 15693 State Transitions Diagram
RESPONSE LEGEND:
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 13
ABRIDGED DATA SHEET
RESPONSE TO
RESPONSE TO
NO RESPONSE
ADDRESS MODE LEGEND:
RESET TO READY
SELECT
POWER-OFF
[N] NONADDRESSED
[A] ADDRESSED
[S] SELECTED
OUT OF FIELD
RESET TO READY [A]
MATCHING UID
NOTE 2
NOTE 1: THE SLAVE PROCESSES THE INVENTORY COMMAND AND OTHER COMMANDS PROVIDED THAT THEY ARE SENT IN THE [N] OR [A] ADDRESS MODE.
NOTE 2: THE SLAVE PROCESSES ONLY COMMANDS SENT IN THE [A] ADDRESS MODE.
NOTE 3: THE SLAVE PROCESSES THE INVENTORY COMMAND AND OTHER COMMANDS IN ANY ADDRESS MODE.
OUT OF FIELD
READY
SELECT [A]
MATCHING UID
STAY QUIET [A]
MATCHING UID
STAY QUIET [A] MATCHING UID
SELECT [A] MATCHING UID
IN FIELD
NOTE 1
OUT OF FIELD
RESET TO READY
[N, A, S]
SELECT [A],
NONMATCHING UID
SELECTEDQUIET
NOTE 3
MAX66140
Request Flags
The command descriptions on the subsequent pages begin with a byte called request flags. The ISO 15693 standard defines two formats for the request flags byte. The state of the Inventory_flag bit controls the function of the bits
in the upper half of the request flag byte. The function of the request flags is as follows:
Request Flags, Inventory_flag Bit Not Set
Bits 8 and 4: No Function
These bits have no function. They must be transmitted as 0.
Bit 7: Options Flag (Option_flag)
This bit is used with block read commands to include the block security status in the response. If not applicable for a
command, the Option_flag bit must be 0.
Bit 6: Address Flag (Address_flag)
This bit specifies whether all slaves in the master’s field that are in the selected or ready state process the request
(bit = 0) or only the single slave whose UID is specified in the request (bit = 1). If the Address_flag bit is 0, the
request must not include a UID. The combination of both the Select_flag and Address_flag bits being set (= 1) is not
valid.
Bit 5: Select Flag (Select_flag)
This bit specifies whether the request is processed only by the slave in the selected state (bit = 1) or by any slave
according to the setting of the Address_flag bit (bit = 0).
Bit 3: Inventory Flag (Inventory_flag)
This bit must be 1 for the Inventory command only. For all other commands, this bit must be 0.
Bit 2: Data Rate Flag (Data_rate_flag)
This bit specifies whether the response data packet is transmitted using the low data rate (bit = 0) or the high data
rate (bit = 1).
Bit 1: Subcarrier Flag (Subcarrier_flag)
This bit specifies whether the response data packet is transmitted using a single subcarrier (bit = 0) or two subcarriers (bit = 1).
ISO 15693-Compliant Secure Memory
14 ______________________________________________________________________________________
ABRIDGED DATA SHEET
BIT 8 (MS) BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT1 (LS)
0 Option_flag Address_flag Select_flag 0 Inventory_flag (= 0) Data_rate_flag Subcarrier_flag
MAX66140
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 15
Request Flags, Inventory_flag Bit Set
Bits 8, 7, and 4: No Function
These bits have no function. They must be transmitted as 0.
Bit 6: Slot Counter Flag (Nb_slots_flag)
This bit specifies whether the command is processed using a slot counter (bit = 0) or without using the slot counter
(bit = 1).
Bit 5: Application Family Identifier Flag (AFI_flag)
To detect only slaves with a certain AFI value, the AFI_flag bit must be 1 and the desired AFI value must be included
in the request. If the least significant nibble of the AFI in the request is 0000b, slaves process the command only if
the most significant nibble of the AFI matches. If the AFI in the request is 00h, all slaves process the command
regardless of their AFI.
Bit 3: Inventory Flag (Inventory_flag)
This bit must be 1 for the Inventory command only. For all other commands, this bit must be 0.
Bit 2: Data Rate Flag (Data_rate_flag)
This bit specifies whether the response data packet is transmitted using the low data rate (bit = 0) or the high data
rate (bit = 1).
Bit 1: Subcarrier Flag (Subcarrier_flag)
This bit specifies whether the response data packet is transmitted using a single subcarrier (bit = 0) or two subcarriers (bit = 1).
Network Function Commands
The command descriptions show the data fields of the request and response data packets. To create the complete
frame, an SOF, 16-bit CRC, and EOF must be added (see Figure 5). The ISO 15693 standard defines four network
function commands: Inventory, Stay Quiet, Select, and Reset to Ready. This section describes the format of the
request and response data packets.
Inventory
This command allows the master to learn the UIDs and DSFIDs of all slaves in its RF field in an iterative process. It is
the only command for which the Inventory_flag bit must be 1. The Inventory command uses two command-specific
parameters, which are the mask length and the mask pattern. The mask allows the master to preselect slaves for
responding to the Inventory command. The LSb of the mask aligns with the LSb of the slave’s UID. The master can
choose not to use a mask, in which case all slaves qualify, provided they are not excluded by the AFI criteria (see
the
Request Flags
section). The maximum mask length is 60 (3Ch, if Nb_slots_flag = 0) or 64 (40h, if Nb_slots_flag =
1). The mask pattern defines the least significant bits (as many as specified by the mask length) that a slave’s UID
must match to qualify for responding to the Inventory command (case Nb_slots_flag = 1). If the slot counter is used
(Nb_slots_flag = 0), the value of the slot counter extends the mask pattern at the higher bits for comparison to the
slave’s UID. The slot counter starts at 0 after the inventory request frame is transmitted and increments during the
course of the Inventory command with every subsequent EOF sent by the master. The processing of an Inventory
command ends when the master sends the SOF of a new frame.
ABRIDGED DATA SHEET
BIT 8 (MS) BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 (LS)
0 0 Nb_slots_flag AFI_flag 0 Inventory_flag (= 1) Data_rate_flag Subcarrier_flag
MAX66140
Request Data for the Inventory Command
Response Data for the Inventory Command (No Error)
This response is generated only if a slave qualifies to respond. In case of an error in the request, slaves do not
respond.
When receiving the Inventory command, the slave devices in the RF field enter the collision management sequence.
If a slave meets the conditions to respond, it sends out a response data packet. If multiple slaves qualify, e.g., AFI,
mask, and slot counter are not used, the response frames collide and are not readable. To receive readable
response frames with the UID and DSFID, the master must eliminate the collision.
Not knowing the slave population, the master could begin with a mask length of 0 and activate the slot counter. By
using this method and going through all 16 slots, the master has a chance to receive clean responses (i.e., the slave
is identified) as well as colliding responses. To prevent a slave that has been identified from further participating in
the collision management sequence, the master transitions it to the quiet state. Next, the master issues another
Inventory command where the slot number that previously generated a collision is now used as a 4-bit mask, and
runs again through all 16 slots. If a collision is found, another inventory command is issued, this time with a mask that
is extended at the higher bits by the slot counter value that produced the collision. This process is repeated until all
slaves are identified. For a full description of the Inventory command processing by the slave device and the timing
specifications, refer to ISO 15693 Part 3, Sections 8 to 9.
Stay Quiet
This command addresses an individual slave and transitions it to the quiet state. The request must be sent in the
addressed mode (Select_flag bit = 0, Address_flag bit = 1). The slave transitioning to the quiet state does not send a
response.
Request Data for the Stay Quiet Command
Select
This command addresses an individual slave and transitions it to the selected state. The request must be sent in the
addressed mode (Select_flag bit = 0, Address_flag bit = 1). The slave transitioning to the selected state sends a
response. If there was a slave with a different UID in the selected state, then that slave transitions to the ready state
without sending a response.
ISO 15693-Compliant Secure Memory
16 ______________________________________________________________________________________
ABRIDGED DATA SHEET
Note 1: The AFI byte is transmitted only if the AFI_flag bit is set to 1. The AFI byte, if transmitted, narrows the range of slaves that
qualify for responding to the request.
Note 2: The mask pattern is transmitted only if the selection mask length is not 0. If the mask length is not an integer multiple of 8,
the MSB of the mask pattern must be padded with 0 bits. The LSB of the mask pattern is transmitted first.
REQUEST FLAGS COMMAND
(1 Byte) 01h (1 Byte) (1 Byte) (Up to 8 Bytes)
AFI
(NOTE 1)
MASK LENGTH
RESPONSE FLAGS DSFID UID
00h (1 Byte) (8 Bytes)
MASK PATTERN
(NOTE 2)
REQUEST FLAGS COMMAND UID
(1 Byte) 02h (8 Bytes)
MAX66140
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 17
Request Data for the Select Command*
Reset to Ready
This command addresses an individual slave and transitions it to the ready state. To address a slave in the quiet
state, the request must be sent in the addressed mode (Select_flag bit = 0, Address_flag bit = 1). To address a
slave in the selected state, the request can be sent in any address mode. The slave transitioning to the ready state
sends a response.
Request Data for the Reset to Ready Command*
Memory and Control Function Commands
The command descriptions show the data fields of the request and response data packets. To create the complete
frame, an SOF, 16-bit CRC, and EOF must be added (see Figure 5). ISO 15693 defines three address modes,
selected, addressed, and nonaddressed, which are specified through the setting of the Select_flag bit and the
Address_flag bit. The memory and control function commands can be issued in any address mode. To access
slaves in the quiet state, the addressed mode is required. The addressed mode requires that the master include the
slave’s UID in the request.
*
If this command is processed without any error, the slave responds with a response flags byte of 00h.
*
If this command is processed without any error, the slave responds with a response flags byte of 00h.
**
The UID is transmitted only in the addressed mode.
ABRIDGED DATA SHEET
REQUEST FLAGS COMMAND UID
(1 Byte) 25h (8 Bytes)
REQUEST FLAGS COMMAND UID**
(1 Byte) 26h (8 Bytes)
MAX66140
Error Indication
Depending on the complexity of a function, various error conditions can occur. In case of an error, the response to a
request begins with a response flags byte 01h followed by one 1-byte error code.
Table 6 shows a matrix of commands and potential errors. If there was no error, the response begins with a
response flags byte 00h followed by command-specific data, as specified in the detailed command description.
If the MAX66140 does not recognize a command, it does not generate a response.
ISO 15693-Compliant Secure Memory
18 ______________________________________________________________________________________
ABRIDGED DATA SHEET
Table 6. Error Code Matrix
Refer to the full data sheet for this information.
Detailed Command Descriptions
In the request data graphics of this section, the UID field is shaded to indicate that the inclusion of the UID depends
on the address mode.
Get System Information
This command allows the master to retrieve technical information about the MAX66140. The IC reference code indicates the die revision in hexadecimal format, such as A1h, A2h, B1h, etc.
Request Data for the Get System Information Command
Response Data for the Get System Information Command (No Error)
For additional command descriptions, refer to the full data sheet.
MAX66140
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 19
ABRIDGED DATA SHEET
REQUEST FLAGS COMMAND UID
(1 Byte) 2Bh (8 Bytes)
RESPONSE
FLAGS
00h 0Fh (8 Bytes) (1 Byte) (1 Byte) 13h 07h (1 Byte)
INFO
FLAGS
UID DSFID AFI
NUMBER OF
BLOCKS
MEMORY BLOCK
SIZE
IC REFERENCE
CRC Generation
The MAX66140 uses two different types of CRCs. One
CRC is an 8-bit type. The equivalent polynomial function of this CRC is X8+ X5+ X4+ 1.
The other CRC is a 16-bit type, generated according to
the CRC-16-CCITT polynomial function (see Figure 18)
X16+ X12+ X5+ 1. This CRC is used for error detection in request and response data packets and is
always communicated in the inverted form. After all
data bytes are shifted into the CRC generator, the state
of the 16 flip-flops is parallel-copied to a shift register
and shifted out for transmission with the LSb first. For
more details on this CRC, refer to ISO/IEC 15693-3,
Annex C.
MAX66140
ISO 15693-Compliant Secure Memory
______________________________________________________________________________________ 29
ABRIDGED DATA SHEET
MAX66140
ISO 15693-Compliant Secure Memory
30 ______________________________________________________________________________________
ABRIDGED DATA SHEET
Figure 17. 8-Bit CRC Generator
Figure 18. CRC-16-CCITT Generator
POLYNOMIAL = X8 + X5 + X4 + 1
MSb LSb
1ST
STAGE
0
X
2ND
STAGE
1
X
3RD
STAGE
2
X
4TH
STAGE
3
X
5TH
STAGE
4
X
6TH
STAGE
5
X
6
X
7TH
STAGE
8TH
STAGE
7
X
8
X
MSb
1ST
STAGE
0
X
STAGE
8
X
9TH
1
X
9
X
2ND
STAGE
10TH
STAGE
INPUT DATA
POLYNOMIAL = X16 + X12 + X5 + 1
3RD
STAGE
2
X
11TH
STAGE
10
X
4TH
STAGE
3
X
12TH
STAGE
11
X
5TH
STAGE
4
X
13TH
STAGE
12
X
6TH
STAGE
5
X
14TH
STAGE
13
X
7TH
STAGE
6
X
15TH
STAGE
14
X
7
X
15
X
INPUT DATA
STAGE
LSb
16TH
STAGE
8TH
16
X
MAX66140
ISO 15693-Compliant Secure Memory
36 ______________________________________________________________________________________
ABRIDGED DATA SHEET
MAX66140K-000AA+MAX66140K-000AA+
TOP VIEW
SIDE VIEW
54mm
28mm
7.7mm
1.6mm
85.60mm
53.98mm
0.76mm
14.29mm
3.49mm
MAX66140E-000AA+
TOP VIEW
SIDE VIEW
KEY FOB
ISO CARD
Mechanical Drawings
MAX66140
ISO 15693-Compliant Secure Memory
Maxim cannot assume responsibility for use of any circuitry other than circuitry entirely embodied in a Maxim product. No circuit patent licenses are
implied. Maxim reserves the right to change the circuitry and specifications without notice at any time.
Maxim Integrated Products, 120 San Gabriel Drive, Sunnyvale, CA 94086 408-737-7600 ____________________
37
© 2011 Maxim Integrated Products Maxim is a registered trademark of Maxim Integrated Products, Inc.
Revision History
ABRIDGED DATA SHEET
REVISION
NUMBER
0 4/10 Init ial release —
1 1/11 Added ISO card option to the Ordering Information and Mechanical Drawings 1, 2, 3, 36
REVISION
DATE
DESCRIPTION
PAGES
CHANGED
Loading...