ST CR95HF User Manual

13.56-MHz multi-protocol contactless transceiver IC

VFQFPN32 5x5 mm

Features

■ Operating modes supported:

– Reader/Writer

■ Hardware features

– Dedicated internal frame controller – Highly integrated Analog Front End (AFE)

for RF communications – Transmission and reception modes – Optimized power management – Tag Detection mode

■ RF communication @13.56 MHz

– ISO/IEC 14443 Type A and B – ISO/IEC 15693 – ISO/IEC 18092

■ Communication interfaces with a Host

Controller – Serial peripheral interface (SPI) Slave

interface – Universal asynchronous

receiver/transmitter (UART) – 256-byte command buffer (FIFO)

■ 32-lead, 5x5 mm, very thin fine pitch quad flat

(VFQFPN) ECOPACK® package

CR95HF

with SPI and UART serial access

Datasheet − production data

Applications

Typical protocols supported:

■ ISO/IEC 14443-3 Type A and B tags

■ ISO/IEC 15693 and ISO/IEC 18000-3M1 tags

■ NFC Forum tags: Types 1, 2, 3 and 4

■ ST short-range interface (SRI) tags

■ ST long-range interface (LRI) tags

■ ST Dual Interface EEPROM

July 2012 Doc ID 018669 Rev 8 1/63

This is information on a product in full production.

www.st.com

Contents CR95HF

Contents

1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.1 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.2 List of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 Pin and signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

3 Power management and operating modes . . . . . . . . . . . . . . . . . . . . . . . 8

3.1 Operating modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3.2 Startup sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4 Communication protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

4.1 Universal asynchronous receiver/transmitter (UART) . . . . . . . . . . . . . . . 11

4.2 Serial peripheral interface (SPI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4.2.1 Polling mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4.2.2 Interrupt mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

5 Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

5.1 Command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

5.2 List of commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

5.3 IDN command (0x01) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

5.4 Protocol Select command (0x02) description . . . . . . . . . . . . . . . . . . . . . . 15

5.5 Send Receive (SendRecv) command (0x04) description . . . . . . . . . . . . . 19

5.6 Idle command (0x07) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

5.6.1 Idle command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5.6.2 Using LFO frequency setting to reduce power consumption . . . . . . . . . 26

5.6.3 Optimizing wake-up conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5.6.4 Using various techniques to return to Ready state . . . . . . . . . . . . . . . . 27

5.6.5 Tag detection calibration procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.7 Read Register (RdReg) command (0x08) description . . . . . . . . . . . . . . . 30

5.8 Write Register (WrReg) command (0x09) description . . . . . . . . . . . . . . . 30

5.8.1 Improving RF performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.8.2 Improving frame reception for ISO/IEC 14443 Type A tags . . . . . . . . . . 32

5.8.3 Improving RF reception for ISO/IEC 18092 tags . . . . . . . . . . . . . . . . . . 33

5.8.4 Managing VPS_TX consumption in Ready state . . . . . . . . . . . . . . . . . . 34

5.9 BaudRate command (0x0A) description . . . . . . . . . . . . . . . . . . . . . . . . . 35

2/63 Doc ID 018669 Rev 8

CR95HF Contents

5.10 Echo command (0x55) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

6 Electrical characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6.1 Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

6.2 DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.3 Power consumption characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.4 SPI characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

6.5 RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

6.6 Oscillator characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

7 Package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

8 Part numbering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Appendix A Additional Idle command description . . . . . . . . . . . . . . . . . . . . . . . 46

Appendix B Example of tag detection calibration process . . . . . . . . . . . . . . . . 47

Appendix C Example of tag detection command using results of tag detection

calibration50

Appendix D Examples of CR95HF command code to activate NFC Forum and

ISO/IEC 15693 tags51

D.1 ISO/IEC 14443 Type A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

D.1.1 NFC Forum Tag Type 1 (Topaz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

D.1.2 NFC Forum Tag Type 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

D.1.3 NFC Forum Tag Type 4A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

D.2 ISO/IEC 14443 Type B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

D.2.1 NFC Forum Tag Type 4B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

D.3 ISO/IEC 18092 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

D.3.1 NFC Forum Tag Type 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

D.4 ISO/IEC 15693 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

D.4.1 ISO/IEC 15693 tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Doc ID 018669 Rev 8 3/63

Description CR95HF

CR95HF

Host

Interrupt Management

SPI

UART

Controller

(MCU)

CR95HF

Frame Controller

AFE IP

Configuration

Reader

ISO/IEC 14443 Type A and B

ISO/IEC 15693

ISO/IEC 18092

Digital

Tag

Detector

Timer Accelerators

Encoder/DecoderFIFO

AFE

Signal

Mux

Mod/

Demod

Tag

Detector

Status

registers

User interface

SPI UART Interrupt

Power & Clock

Management

Host

(User Side)

XIN XOUT

TX1

TX2

RX2

RX1

VPS_TX

GND_TX

VPS_Main GND_Dig

GND_RX

27.12 MHz

1 Description

The CR95HF is an integrated transceiver IC for contactless applications.

The CR95HF manages frame coding and decoding in Reader mode for standard applications such as near field communication (NFC), proximity and vicinity standards.

The CR95HF embeds an Analog Front End to provide the 13.56 MHz Air Interface.

The CR95HF supports ISO/IEC 14443 Type A and B, ISO/IEC 15693 (single or double subcarrier) and ISO/IEC 18092 protocols.

The CR95HF also supports the detection, reading and writing of NFC Forum Type 1, 2, 3 and 4 tags.

Figure 1. CR95HF application overview

1.1 Block diagram

Figure 2. CR95HF block diagram

4/63 Doc ID 018669 Rev 8

CR95HF Description

1.2 List of terms

Table 1. List of terms

Term Meaning

DAC Digital analog converter

GND Ground

HFO High frequency oscillator

LFO Low frequency oscillator

MCU Microcontroller unit

NFC Near Field Communication

RFID Radio Frequency Identification

RFU Reserved for future use

SPI Serial peripheral interface

REF

UART Universal asynchronous receiver-transmitter

WFE Wait For Event

Low frequency period

Reference time

Doc ID 018669 Rev 8 5/63

Pin and signal descriptions CR95HF

VPS_TX

GND_TX

XOUT

XIN

GND

ST_R1

SSI_1

SPI_MISO

SPI_SS

UART_RX / IRQ_IN

VPS

TX1

TX2

RX1

Shaded area represents the dissipation pad. (Must be connected to ground.)

RX2

GND_RX

SSI_0

SPI_SCK

SPI_MOSI

ST_R0

UART_TX / IRQ_OUT

2 Pin and signal descriptions

Figure 3. Pinout description

Table 2. Pin descriptions

Pin Pin name Type

(1)

1 TX1 O Driver output 1

2 TX2 O Driver output 2

3 NC Not connected

4 NC Not connected

5 RX1 I Receiver input 2

6 RX2 I Receiver input 1

6/63 Doc ID 018669 Rev 8

7 NC Not connected

8 GND_RX P Ground (analog)

9 ST_R0 O ST Reserved

10 NC Not connected

11 NC Not connected

12 UART_RX / IRQ_IN

13 VPS P Main power supply

14 UART_TX / IRQ_OUT

(3)

UART receive pin

O UART transmit pin Interrupt output

Main function Alternate function

(2)

(4)

Interrupt input

CR95HF Pin and signal descriptions

Table 2. Pin descriptions (continued)

Pin Pin name Type

15 SPI_SS

16 SPI_MISO O SPI Data, Slave Output

17 SPI_MOSI I SPI Data, Slave Input

18 SPI_SCK I

19 SSI_0 I

20 SSI_1 I

21 ST_R1 I

22 GND P Ground (digital)

23 NC Not connected

24 NC Not connected

25 NC Not connected

26 NC Not connected

27 NC Not connected

28 NC Not connected

29 XIN Crystal oscillator input

30 XOUT Crystal oscillator output

31 GND_TX P Ground (RF drivers)

32 VPS_TX P Power supply (RF drivers)

1. I: Input, O: Output, and P: Power

2. Must add a capacitor to ground (~1 nF).

3. Pad internally connected to a Very Weak Pull-up to VPS.

4. We recommend connecting this pin to the V

5. Pad internally connected to a Weak Pull-up to VPS.

6. Must not be left floating.

7. Pad internally connected to a Weak Pull-down to GND.

8. Pad input in High Impedance. Must be connected to VPS.

(1)

(5)

SPI Slave Select (active low)

(7)

SPI serial clock

Main function Alternate function

Select serial communication interface

(8)

ST Reserved

pin using a 3.3 kOhm pull-up resistor.

(6)

Doc ID 018669 Rev 8 7/63

Power management and operating modes CR95HF

3 Power management and operating modes

3.1 Operating modes

The CR95HF has 2 operating modes: Wait for Event (WFE) and Active. In Active mode, the CR95HF communicates actively with a tag or an external host (an MCU, for example). WFE mode includes four low consumption states: Power-up, Hibernate, Sleep and Tag Detector.

The CR95HF can switch from one mode to another.

Table 3. CR95HF operating modes and states

Mode State Description

This mode is accessible directly after POR.

Wait For Event (WFE)

Active

Power-up

Hibernate

Sleep

Tag De te cto r

Ready

Reader

Low level on IRQ_IN source. LFO (low-frequency oscillator) is running in this state.

Lowest power consumption state. The CR95HF has to be woken-up in order to communicate. Low level on IRQ_IN pin (longer than 10 µs) is the only wakeup source.

Low power consumption state. Wakeup source is configurable: –Timer –IRQ_IN – SPI_SS pin LFO (low-frequency oscillator) is running in this state.

Low power consumption state with tag detection. Wakeup source is configurable:

–Timer –IRQ_IN – SPI_SS – Tag detector LFO (low-frequency oscillator) is running in this state.

In this mode, the RF is OFF and the CR95HF waits for a command (P interface (UART or SPI).

The CR95HF can communicate with a tag using the selected protocol or with an external host using the selected serial interface (UART or SPI).

ROTOCOLSELECT, ...) from the external host via the selected serial

pin (longer than 10 µs) is the only wakeup

Hibernate, Sleep and Tag Detector states can only be activated by a command from the external host. As soon as any of these three states are activated, the CR95HF can no longer communicate with the external host. It can only be woken up.

The behavior of the CR95HF in 'Tag Detector' state is defined by the Idle command.

8/63 Doc ID 018669 Rev 8

CR95HF Power management and operating modes

Supply off

Power-up

POR

Ready

Reader

Tag Detector

(& Calibration )

Sleep

IRQ_IN

Protocol Select

POR sequence Wake-up event

Hibernate

TimeOut

Tag Detection

Idle command

IRQ_IN

Activ e

WFE

IRQ_IN

Protocol Select

Serial I/F selection

SPI Reset

Figure 4. CR95HF initialization and operating state change

3.2 Startup sequence

After the power supply is established at power-on, the CR95HF waits for a low pulse on the pin IRQ_IN entering Ready state after a delay (t

Figure 5. Power-up sequence

1. Note for pin SSI0: - - - SPI selected, –––– UART selected

2. Pin IRQ_IN

Note: When CR95HF leaves WFE mode (from Power-up, Hibernate, Sleep or Tag Detector)

following an |RQ_IN character.

(t1) before automatically selecting the external interface (SPI or UART) and



603

33)?



&IRSTVALID



COMMAND

-36

33)?

)21?).

low level < 0.2 VPS_Main.

/RX low level pulse, this pulse is NOT interpreted as the UART start bit





Doc ID 018669 Rev 8 9/63

Power management and operating modes CR95HF

Figure 5 shows the power-up sequence for a CR95HF device; where,

● t

is the initial wake-up delay 100 µs (minimum)

● t

is the minimum interrupt width 10 µs (minimum)

● t

is the delay for the serial interface selection 250 ns (typical)

● t

is the HFO setup time (t

● t

is the VPS ramp-up time 10 ms (maximum by design

SU(HFO)

) 10 ms (maximum)

validation)

Note: The Serial Interface is selected after the following falling edge of pin IRQ_IN

from POR or Hibernate state.

Ta bl e 4 lists the signal configuration used to select the serial communication interface.

Table 4. Select serial communication interface selection table

Pin UART SPI

SSI_0 0 1

SSI_1 0 0

when leaving

10/63 Doc ID 018669 Rev 8

CR95HF Communication protocols

Sending commands to the CR95HF

Receiving data from the CR95HF

CMD LEN DATA DATA

Several data bytes

Resp Code LEN DATA DATA

Several data bytes

Ai18122a

CR95HF

Internal

Clock

0123 4567

10101010

1 1

(Stop)

(Echo 0x55)

Host to CR95HF

CR95HF to Host

(Start)

10101010

1 1

(Stop)

(Echo 0x55)

(Start)

4 Communication protocols

4.1 Universal asynchronous receiver/transmitter (UART)

The host sends commands to the CR95HF and waits for replies. Polling for readiness is not necessary. The default baud rate is 57600 baud. The maximum allowed baud rate is 2 Mbps.

Figure 6. UART communication

When sending commands, no data must be sent if the LEN field is zero.

When receiving data from the CR95HF, no data will be received if the LEN field is zero.

The formats of send and receive packets are identical.

If an E

CHO command is sent, only one byte (0x55) is sent by the host.

Figure 7 shows an example of an E

Figure 7. ECHO command and response example

CHO command.

Caution: UART communication is LSB first. Stop bit duration is two Elementary Time Units

(ETUs).

Note: 1 When CR95HF leaves WFE mode (from Power-up, Hibernate, Sleep or Tag Detector)

following an |RQ_IN character.

2 If the user loses UART synchronization, it can be recovered by sending an E

until a valid E CR95HF will reply with an error code meaning its input buffer is full. The user can now restart a UART exchange.

/RX low level pulse, this pulse is NOT interpreted as the UART start bit

CHO command

CHO reply is received. Otherwise, after a maximum of 255 ECHO commands,

Doc ID 018669 Rev 8 11/63

Communication protocols CR95HF

MOSI

0 0 0 0 0 0 0 0 CMD LEN DATA DATA

Control Byte

MISO

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Several data bytes

MOSI

0 0 0 0 0 0 1 1 X X X X X X 1 1 X X X X X X 1 1 X X X X X X 1 1

Control Byte

MISO

X X X X X X X X

Flag Flag

Flags are polled until data is ready (Bit 3 is set when data is ready)

0 0 0 0 0 X X X 0 0 0 0 0 X X X 0 0 0 0 1 X X X

4.2 Serial peripheral interface (SPI)

4.2.1 Polling mode

In order to send commands and receive replies, the application software has to perform 3 steps.

1. Send the command to the CR95HF.

2. Poll the CR95HF until it is ready to transmit the response.

3. Read the response.

The application software should never read data from the CR95HF without being sure that the CR95HF is ready to send the response.

The maximum allowed SPI communication speed is f

SCK

A Control byte is used to specify a communication type and direction:

● 0x00: Send command to the CR95HF

● 0x03: Poll the CR95HF

● 0x02: Read data from the CR95HF

● 0x01: Reset the CR95HF

The SPI_SS

line is used to select a device on the common SPI bus. The SPI_SS pin is

active low.

When the SPI_SS

line is inactive, all data sent by the Master device is ignored and the

MISO line remains in High Impedance state.

Figure 8. Sending command to CR95HF

Figure 9. Polling the CR95HF until it is ready

Table 5. Interpretation of flags

Bit Meaning (Application point of view)

[7:4] Not significant

3 Data can be read from the CR95HF when set.

2 Data can be sent to the CR95HF when set.

[1:0] Not significant

12/63 Doc ID 018669 Rev 8

CR95HF Communication protocols

MOSI

0 0 0 0 0 0 1 0 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Control Byte

MISO

X X X X X X X X Resp Code LEN DATA DATA

Several data bytes

MOSI

0 0 0 0 0 0 0 1

Control Byte 01

MISO

X X X X X X X X

Figure 10. Reading data from CR95HF

Data must be sampled at the rising edge of the SCK signal.

‘Sending’, ‘Polling’ and ‘Reading’ commands must be separated by a high level of the SPI_SS asserts the SPI_SS

line. For example, when the application needs to wait for data from the CR95HF, it

line low and issues a ‘Polling’ command. Keeping the SPI_SS line low, the Host can read the Flags Waiting bit which indicates that the CR95HF can be read. Then, the application has to assert the SPI_SS asserts the SPI_SS

line low and issues a ‘Reading’ command to read data. When all data is read, the application asserts the SPI_SS

line high to finish the polling command. The Host

line high.

The application is not obliged to keep reading Flags using the Polling command until the CR95HF is ready in one command. It can issue as many 'Polling' commands as necessary. For example, the application asserts SPI_SS Flags. If the CR95HF is not ready, the application can assert SPI_SS

low, issues 'Polling' commands and reads

high and continue its algorithm (measuring temperature, communication with something else). Then, the application can assert SPI_SS

low again and again issue 'Polling' commands, and so on, as

many times as necessary, until the CR95HF is ready.

Note that at the beginning of communication, the application does not need to check flags to start transmission. The CR95HF is assumed to be ready to receive a command from the application.

Figure 11. Reset the CR95HF

To reset the CR95HF using the SPI, the application sends the SPI Reset command (Control Byte 01, see Figure 11) which starts the internal controller reset process and puts the CR95HF into Power-up state. The CR95HF will wake up when pin IRQ_IN CR95HF reset process only starts when the SPI_SS

Caution: SPI communication is MSB first.

4.2.2 Interrupt mode

When the CR95HF is configure to use the SPI serial interface, pin IRQ_OUT is used to give additional information to user. When the CR95HF is ready to send back a reply, it sends an Interrupt Request by setting a low level on pin IRQ_OUT reads the data.

goes low. The

pin returns to high level.

, which remains low until the host

The application can use the Interrupt mode to skip the polling stage.

Caution: SPI communication is MSB first.

Doc ID 018669 Rev 8 13/63

Commands CR95HF

5 Commands

5.1 Command format

● The frame from the Host to the CR95HF has the following format:

● The frame from the CR95HF to Host has the following format:

These two formats are available either in both UART and SPI modes.

Fields <Cmd>, <RespCode> and <Len> are always 1 byte long. <Data> can be from 0 to 255 bytes.

Note: The E

CHO command is an exception as it has only one byte (0x55).

The following symbols correspond to:

>>> Frame sent by the Host to CR95HF

<<< Frame sent by the CR95HF to the Host

5.2 List of commands

Ta bl e 6 summarizes the available commands.

Table 6. List of CR95HF commands

Code Command Description

0x01 IDN Requests short information about the CR95HF and its revision.

0x02 P

0x04 SENDRECV

0x07 I

0x08 R

0x09 W

ROTOCOLSELECT

DLE

DREG

RREG

Selects the RF communication protocol and specifies certain protocol-related parameters.

Sends data using the previously selected protocol and receives the tag response.

Switches the CR95HF into a low consumption Wait for Event (WFE) mode (Power-up, Hibernate, Sleep or Tag detection), specifies the authorized wake-up sources and waits for an event to exit to Ready state.

Reads Wake-up event register or the Analog Register Configuration (ARC_B) register.

Writes Analog Register Configuration (ARC_B) register or writes index of ARC_B register address.

Writes the Timer Window (TimerW) value dedicated to ISO/IEC 14443 Type A tags.

Writes the AutoDetect Filter enable register dedicated to ISO/IEC 18092 tags.

0x0A B

0x55 E

14/63 Doc ID 018669 Rev 8

AUDRATE Sets the UART baud rate.

CHO CR95HF returns an ECHO response (0x55).

Other codes ST Reserved

CR95HF Commands

5.3 IDN command (0x01) description

The IDN command (0x01) gives brief information about the CR95HF and its revision.

Table 7. IDN command description

Direction Data Comments Example

Host to CR95HF

CR95HF to Host

It takes approximately 6 ms to calculate the CRC for the entire ROM. The application must allow sufficient time for waiting for a response for this command.

0x01 Command code

0x00 Length of data

0x00 Result code <<<0x000F4E4643204653324A41535

<Len> Length of data

<Device ID> Data in ASCII format

CRC calculated for ROM content

>>>0x0100

4320075D2

In this example,

<<<0x4E4643204653324A415354320 0: ‘NFC FS2JAST2’, #2 (Last Character

of NFC FS2JAST2 means ROM code revision 2.)

0x75D2: CRC of ROM (real CRC may differ from this example)

5.4 Protocol Select command (0x02) description

This command selects the RF communication protocol and prepares the CR95HF for communication with a contactless tag.

Table 8. PROTOCOLSELECT command description

Direction Data Comments Example

0x02 Command code

<Len> Length of data

Protocol codes 00: Field OFF

See Table 9: List of <Parameters>

values for the ProtocolSelect command for different protocols on page 16 for a

detailed example.

<<<0x0000

Protocol is successfully selected

<<<0x8200

Invalid command length

Host to CR95HF

CR95HF to Host

01: ISO/IEC 15693

0x00 Result code

0x00 Length of data

0x82 Error code

0x00 Length of data

02: ISO/IEC 14443-A 03: ISO/IEC 14443-B 04: ISO/IEC 18092 /NFC

Forum Tag Type 3

Each protocol has a different set of parameters. See Tab l e 9 .

Doc ID 018669 Rev 8 15/63

Commands CR95HF

Table 8. PROTOCOLSELECT command description (continued)

Direction Data Comments Example

CR95HF to Host

0x83 Error code

0x00 Length of data

<<<0x8300

Invalid protocol

Note that there is no ‘Field ON’ command. When the application selects an RF communication protocol, the field automatically switches ON.

When the application selects a protocol, the CR95HF performs all necessary settings: it will choose the appropriate reception and transmission chains, switch ON or OFF the RF field and connect the antenna accordingly.

Different protocols have different sets of parameters. Values for the <Parameters> field are listed in Ta bl e 9 .

Table 9. List of <Parameters> values for the PROTOCOLSELECT command for

different protocols

Parameters

Protocol Code

Byte Bit Function

Field OFF 0x00 07:0RFU >>>0x02020000

7:6 RFU

00: 26 Kbps (H) 01: 52 Kbps

5:4

10: 6 Kbps (L) 11: RFU

0: Respect 312-µs delay

ISO/IEC 15693 0x01 0

1: Wait for SOF

0: 100% modulation (100)

1: 10% modulation (10)

(1)

Examples of commands

H 100 S: >>>0x02 02 01 01 H 100 D: >>>0x02 02 01 03 H 10 S: >>>0x02 02 01 05 H 10 D: >>>0x02 02 01 07 L 100 S: >>>0x02 02 01 21 L 100 D: >>>0x02 02 01 23 L 10 S: >>>0x02 02 01 25 L 10 D: >>>0x02 02 01 27

0: Single subcarrier (S)

1: Dual subcarrier (D)

Append CRC if set to ‘1’.

(1)

16/63 Doc ID 018669 Rev 8

In these examples, the CRC is automatically appended.

CR95HF Commands

Table 9. List of <Parameters> values for the PROTOCOLSELECT command for

different protocols (continued)

Parameters

Protocol Code

Byte Bit Function

Examples of commands

ISO/IEC 14443 Ty p e A

NFC Forum Tag Ty p e 1

(Topaz)

NFC Forum Tag Ty p e 2

NFC Forum Tag Type 4A

ISO/IEC 14443 Ty p e B

NFC Forum Tag Type 4B

0x02

0x03

1, 2

Transmission data rate

00: 106 Kbps

7:6

01: 212 Kbps 10: RFU 11: RFU

Reception data rate

00: 106 Kbps

5:4

01: 212 Kbps 10: RFU 11: RFU

3RFU

2:0 RFU

AFDT (Optional) 2 bytes 0xPP 0xMM

Set the maximum CR95HF listening time so that it fits the maximum ISO FWT:

0xPP ≤ 0x0E, 0x01 ≤ 0xMM ≤ 0xFE

Transmission data rate

00: 106 Kbps

7:6

01: RFU 10: RFU 11: RFU

Reception data rate

00: 106 Kbps

5:4

01: RFU 10: RFU 11: RFU

3:1 RFU

Append CRC if set to ‘1’.

(1)

(2)

>>>0x02020200: ISO/IEC 14443 Type A tag, 106 Kbps transmission and reception rates, Time interval 86/90

Note that REQA, WUPA, Select20 and Select70 commands use a fixed interval of 86/90 µs between a request and its reply. Other commands use a variable interval with fixed granularity.

Refer to the ISO/IEC 14443 standard for more details.

Frame Waiting Time (FWT) =

) *(MM+1) * 4096/13.56 µs

If AFDT is not specified, the default FWT is ~ 86 µs

>>>0x02020301: ISO/IEC 14443 Type B tag with

CRC appended

AFDT (Optional) 2 bytes

1, 2

0xPP 0xMM Set the maximum CR95HF

listening time so that it fits the maximum ISO FWT:

0xPP ≤ 0x0E,

Frame Waiting Time (FWT) =

) *(MM+1) * 4096/13.56 µs

If AFDT is not specified, the default FWT is ~ 4.8 ms

0x01 ≤ 0xMM ≤ 0xFE

Doc ID 018669 Rev 8 17/63

(3)

Commands CR95HF

Table 9. List of <Parameters> values for the PROTOCOLSELECT command for

different protocols (continued)

Parameters

Protocol Code

ISO/IEC 18092

NFC Forum Tag Ty p e 3

0x04

Byte Bit Function

Transmission data rate

00: RFU

7:6

01: 212 Kbps 10: 424 Kbps 11: RFU

Reception data rate

5:4

00: RFU 01: 212 Kbps 10: 424 Kbps 11: RFU

3:1 RFU

Append CRC if set to ‘1’.

(1)

7:5 RFU

Disregard slot counter

0: Respect slot counter 1: Search for the reply

Slot counter 0: 1 slot

3:0

1: 2 slots … F: 16 slots

Examples of commands

>>>0x02020451: ISO/IEC18092 tag, 212 Kbps

transmission and reception rates with CRC appended.

Parameter ‘Slot counter’ is not mandatory. If it is not present, it is assumed that SlotCounter = 0x00 (1 slot)

For device detection commands, byte 1 bit 4 must be set to ‘0’. In this case, the FWT is 2.4 ms for the 1st slot and

1.2 ms more for each following slot, if slot counter is specified.

If slot counter = 0x10, the CR95HF does not respect reply timings, but polls incoming data and searches a valid response during ~8.4 ms.

AFDT (Optional) 2 bytes 0xPP 0xMM

Set the maximum CR95HF

2,3

listening time so that it fits the maximum ISO FWT:

0xPP ≤ 0x0E, 0x01 ≤ 0xMM ≤ 0xFE

1. It is recommended to set this bit to ‘1’.

2. Not characterized.

3. Max TR1 (Synchronization Time as defined in ISO/IEC 14443-2, Type B) supported by the CR95HF is 170

µs. This value will be increased to 302 µs in the next CR95HF revision.

18/63 Doc ID 018669 Rev 8

Frame Waiting Time (FWT) =

) *(MM+1) * 4096/13.56 µs

If AFDT is not specified, the default FWT is ~ 302 µs

CR95HF Commands

5.5 Send Receive (SendRecv) command (0x04) description

This command sends data to a contactless tag and receives its reply.

Before sending this command, the Host must first send the P

ROTOCOLSELECT command to

select an RF communication protocol.

If the tag response was received and decoded correctly, the <Data> field can contain additional information which is protocol-specific. This is explained in Tab l e 1 1.

Table 10. SENDRECV command description

Direction Data Comments Example

0x04 Command code Host to CR95HF

CR95HF to Host

<Len> Length of data

<Data> Data to be sent

0x80 Result code

<Len> Length of data

Data received.

<Data>

0x90 Result code

0x04 Vali d b its

ACK or NAK

0x86 Error code

0x00 Length of data

0x87 Error code

0x00 Length of data

Interpretation depends on protocol

ISO 14443-A ACK or NAK detection

See Ta b le 1 1 and Ta b le 1 2 for detailed examples.

<<<0x800F5077FE01B30000000000 71718EBA00

The tag response is decoded. This is an example of an ISO/IEC 14443 ATQB response (Answer to Request Type B)

<<<0x900400 Exception for 4-bit frames. This function

is limited. ACK/NAK always returns ‘0’.

<<<0x8600 Communication error

<<<0x8700 Frame wait time out or no

tag

(1)

CR95HF to Host

0x88 Error code

0x00 Length of data

0x89 Error code

0x00 Length of data

0x8A Error code

0x00 Length of data

0x8B Error code

0x00 Length of data

0x8C Error code <<<0x8C00 Invalid length. Used in NFC

0x00 Length of data

0x8D Error code

0x00 Length of data

Doc ID 018669 Rev 8 19/63

<<<0x8800 Invalid SOF

<<<0x8900 Receive buffer overflow

(too many bytes received)

<<<0x8A00 Framing error (start bit = 0, stop bit = 1)

<<<0x8B00 EGT time out (for ISO/IEC 14443-B)

Forum Tag Type 3, when field Length < 3

<<<0x8D00 CRC error (Used in NFC Forum Tag Type 3 protocol)

+ 44 hidden pages