ST25TV02K ST25TV512
Datasheet
NFC Type 5 / RFID tag IC with up to 2-Kbit EEPROM, product identification and protection
Wafer
Product status link
ST25TV02K
ST25TV512
Features
Contactless interface
•Based on ISO/IEC 15693
•NFC Forum Type 5 tag certified by the NFC Forum
•Supports all ISO/IEC 15693 modulations, coding, subcarrier modes and data rates
•Custom Fast read access up to 53 Kbit/s
•Single and multiple block reads
•Single block writes
•Internal tuning capacitance: 23 pF, 99.7 pF
•Proprietary Inventory commands for speeding up the inventory process
Memory
•Up to 2 Kbits of EEPROM
•RF interface accesses blocks of four bytes
•Write time from RF: typical 5 ms for one block
•Data retention: 60 years
•Minimum endurance: 100 k write cycles
•16-bit event counter with anti-tearing
Data protection
•User memory: two or three areas, read and/or write protected by two 32-bit encrypted passwords for three areas or one 64-bit encrypted password for two areas
•System configuration: write protected by a 32-bit encrypted password
•Permanent write locks at a block level
Product identification and protection
•Kill mode and untraceable mode
•Tamper detect capability (patent pending)
•TruST25 digital signature
•EAS (electronic article surveillance) capability
Privacy protection
•Consumer privacy can be protected through the following features:
–Kill mode
–Untraceable mode
•In association with:
–Passwords with cover coding
–Data and configuration locks (permanent or temporary)
Temperature range
•From - 40 to 85 °C
DS12074 - Rev 11 - February 2021 |
www.st.com |
For further information contact your local STMicroelectronics sales office. |
|
|
|
ST25TV02K ST25TV512
Package
•Sawn and bumped wafer, ECOPACK2 (RoHS compliant)
•5-pin package, ECOPACK2 (RoHS compliant)
Compatibility ST25TV02K / LRI2K
•Full compatibility in terms of functionality and capacitances with two exceptions:
–Kill command requires option_flag to be set to 0
–Error codes and error generation can be different on a per command basis
DS12074 - Rev 11 |
page 2/90 |
|
|
ST25TV02K ST25TV512
1Description
ST25TV02K and ST25TV512 are NFC/RFID tag ICs with a tamper-proof feature, and specific modes to protect tag access, such as Untraceable mode.
These devices feature a digital signature used to prove the origin of the chip in cloning detection, embed a configurable EEPROM with 60-year data retention, and can be operated from a 13.56 MHz long-range RFID reader or an NFC phone.
The contactless interface is compatible with the ISO/IEC 15693 standard and NFC Forum Type 5 tag.
Figure 1. ST25TV02K/512 (with tamper detect) block diagram
|
|
|
|
|
|
|
|
|
EEPROM |
|
||
|
|
|
|
|
ISO 15693 |
|
|
xxx-bit |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
256 bits |
|
|
|
|
|
|
|
|
|
|
|
|
(EAS) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
RF Tag |
|
|
|
|
|
256 bits |
|
|
||
|
|
|
Long Range |
|
|
|
signature |
|
|
|||
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2x32-bit password |
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
|
|
|
|
TD(1) |
|
|
|
|
||
|
|
|
|
|
(tamper detect) |
|
||||||
|
|
|
|
|
|
|
|
|
|
|||
|
1. tamper detect is optional. |
|
|
|
|
|||||||
|
|
|
|
|
Table 1. Signal names |
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
||||
Signal name |
|
|
|
Function |
|
|
|
Direction |
||||
|
|
|
|
|
|
|
||||||
AC0 |
|
Antenna coil |
|
|
|
I/O |
||||||
|
|
|
|
|
|
|
||||||
AC1 |
|
Antenna coil |
|
|
|
I/O |
||||||
|
|
|
|
|
|
|
||||||
TD0 |
|
Tamper detect loop |
|
|
|
I/O |
||||||
|
|
|
|
|
|
|
||||||
TD1 |
|
Tamper detect loop |
|
|
|
I/O |
||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
DS12074 - Rev 11 |
page 3/90 |
|
|
ST25TV02K ST25TV512
ST25TV02K/512 block diagram (with tamper detect)
Figure 2. DFN5 package connections diagram (with tamper detect)
TD0 |
1 |
|
ABCD |
5 TD1 |
5 |
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
||||||
|
|
|
|
|
|
|
||||||
NC1 |
2 |
|
2 NC1 |
2 |
|
|
|
|
|
|
2 |
|
|
XYZW |
|
|
|
|
|
|
|||||
AC0 |
3 |
|
4 AC1 |
4 |
|
|
|
|
|
|
3 |
|
|
|
|
|
|
|
|
|
|||||
|
|
|
|
|
|
|
|
|||||
|
|
|
Top view |
|
Bottom view |
|
||||||
|
|
(marking side) |
|
(pads side) |
|
1: Not Connected
Figure 3. Die connections for sawn and bumped wafer (bottom view)
AC0 |
|
TD0 |
|
AC0 |
|
NC |
|
|
|
|
|
|
|
AC1 |
|
TD1 |
|
AC1 |
|
NC |
|
|
|
|
|
|
|
With tamper detect Without tamper detect
DS12074 - Rev 11 |
page 4/90 |
|
|
ST25TV02K ST25TV512
2Description of signals
These inputs are used exclusively to connect the ST25TV02K/512 devices to an external coil. It is advised not to connect any other DC or AC path to AC0 or AC1.
When correctly tuned, the coil is used to power and access the device using the ISO/IEC 15693 and ISO 18000-3 mode 1 protocols.
These inputs are used to connect a wire loop to the ST25TV02K/512 devices to detect an open or a short between the two pins TD0, TD1.
DS12074 - Rev 11 |
page 5/90 |
|
|
ST25TV02K ST25TV512
3Power management
To ensure a proper boot of the RF circuitry, the RF field must be turned ON without any modulation for a minimum period of time tboot_RF. Before this time, ST25TV02K/512 ignores all received RF commands. (See Figure 4. RF power-up sequence).
Figure 4. RF power-up sequence
|
|
|
RF interface ready |
|
||
|
RFfield |
None Access |
RF REQUEST |
|
|
|
|
|
RF ANSWER |
|
|||
|
|
|
|
|||
|
|
Allowed RF |
|
|
||
|
|
|
|
|
|
|
Power-up |
|
tboot_RF |
|
|
|
|
by RF |
|
|
|
|
|
|
Vint_supply |
|
|
|
|
|
To ensure a proper reset of the RF circuitry, the RF field must be turned off (100% modulation) for a minimum tRF_OFF period of time.
DS12074 - Rev 11 |
page 6/90 |
|
|
ST25TV02K ST25TV512
4Memory management
The ST25TV02K/512 memory is divided in two main memory areas:
•User memory
•System configuration area
The ST25TV02K/512 user memory can be divided into two or three user areas. Area 0 starts at address 0, it has 1 block size, it is always readable, and it can be locked.
The rest of the user memory can be either configured as one single area (Area 1) and can be read - and/or - write-protected with one 64-bit password, or configured as two areas (Area 1 and Area 2), which can be
individually read - and/or - write-protected with a 32-bit password each. When Area 2 exists, Area 2 starts at the block number corresponding to half the user memory.
Furthermore, each block can be locked permanently and individually for larger flexibility in number of areas
The ST25TV02K/512 system configuration area contains registers to configure all ST25TV02K/512 features, which can be tuned by user. Its access is protected by a 32 bit configuration password.
This system configuration area also includes read only device information such as IC reference, memory size, as well as a 64-bit block that is used to store the 64-bit unique identifier (UID), the AFI (default 00h) and DSFID
(default 00h) registers, the TruST25™ digital signature. The UID is compliant with the ISO 15693 description, and its value is used during the anticollision sequence (Inventory). The UID value is written by ST on the production line. The AFI register stores the application family identifier. The DSFID register stores the data storage family identifier used in the anticollision algorithm.
The system configuration area includes blocks that store up to two RF user area access passwords and a RF configuration password.
Figure 5. Memory organization
Area 0: |
|
Area 0: |
1 block (always readable) |
1 block (always readable) |
|
|
|
|
User memory |
Area 1 |
|
||
|
|
|
|
|
(EEPROM up |
|
|
Half user |
Area 1 |
to 2-Kbits) |
|
|
||
|
|
|
||
Password |
|
|
memory |
|
|
|
|
|
|
protected |
|
|
|
|
Area 2
Note: Each block can be individually locked
DS12074 - Rev 11 |
page 7/90 |
|
|
ST25TV02K ST25TV512
4.2User memory
User memory is addressed as blocks of 4 bytes, starting at address 0. Table 2. 2Kb user memory as seen by RF shows how memory is seen from RF interface.
Table 2. 2Kb user memory as seen by RF
RF command |
|
|
User memory |
|
|
(block addressing) |
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
RF block 00h |
|
|
|
|
|
|
|
|
|
|
|
Byte |
Byte |
|
Byte |
Byte |
|
0003h |
0002h |
|
0001h |
0000h |
|
|
|
|
|
|
Read Single Block |
RF block 01h |
|
|
|
|
Read Multiple Blocks |
Byte |
Byte |
|
Byte |
Byte |
Fast Read Single Block |
0007h |
0006h |
|
0005h |
0004h |
|
|
|
|
|
|
Fast Read Multiple Blocks |
RF block 02h |
|
|
|
|
Write Single Block |
|
|
|
|
|
Byte |
Byte |
|
Byte |
Byte |
|
Inventory Read |
0011h |
0010h |
|
0009h |
0008h |
Fast Inventory Read |
|
|
|
|
|
.... |
|
|
|
|
|
|
|
|
|
|
|
|
RF block 3Fh |
|
|
|
|
|
|
|
|
|
|
|
Byte |
Byte |
|
Byte |
Byte |
|
03FFh |
03FEh |
|
03FDh |
03FCh |
|
|
|
|
|
|
The user memory can be split into two or three different areas as showed in Table 3. Memory Organization
Table 3. Memory Organization
Part Number |
|
Three areas configuration |
Two areas configuration |
|||
Area 0 |
Area 1 |
Area 2 |
Area 0 |
Area 1 |
||
|
||||||
|
|
|
|
|
|
|
ST25TV512 |
Block 0 |
Block 1 to 7 |
Block 8 to 15 |
Block 0 |
Block 1 to 15 |
|
|
|
|
|
|
|
|
ST25TV02K |
Block 0 |
Block 1 to 31 |
Block 32 to 63 |
Block 0 |
Block 1 to 63 |
|
|
|
|
|
|
|
Each area has a distinct access privilege as explained below:
•Area 0 is always readable. It can be locked.
•Areas 1 and 2 can be protected in read and/or write access by password.
Each block of Areas 1 and 2 can be individually locked (see Section 5.2 Data protection).
In addition to the user memory, the ST25TV02K/512 include a set of registers located in the system configuration area memory (EEPROM nonvolatile registers). These registers are set during device configuration (i.e.: area extension), or by the application (i.e.: area protection)., their content is read during the boot sequence and defines basic ST25TV02K/512 behaviour.
The registers located in the system configuration area can be accessed via dedicated Read Configuration and Write Configuration commands, with a pointer acting as the register address.
The configuration security session must first be open, by presenting a valid configuration password, to grant write access to system configuration registers.
Table 4 shows the complete map of the system configuration area.
DS12074 - Rev 11 |
page 8/90 |
|
|
ST25TV02K ST25TV512
System configuration area
Table 4. System configuration memory map accessible through write_cfg and read_cfg commands
RF access |
|
|
Static Register |
||
Address |
Type |
|
Name |
|
Function |
00h |
RW (1) |
Table 8. A1SS |
|
Area 1 access protection |
|
01h |
RW(1) |
Table 9. A2SS |
|
Area 2 access protection |
|
02h |
RW(1) |
Table 17. EAS_SEC |
|
EAS Security |
|
03h |
RW(1) |
Table 22. |
CNT_CFG |
|
Counter Configuration |
04h |
RO |
Table 23. |
CNT_VAL |
|
Counter Value |
|
|
|
|
|
|
05h |
RO |
Table 24. TAMPER_DETECT |
|
Tamper Detect |
|
|
|
|
|
|
|
06h |
RW(1) |
Table 10. |
LOCK_CFG |
|
Configuration locked |
07h |
RO |
Table 21. |
KID |
|
Key identifier |
|
|
|
|
|
|
1.Write access is granted if RF configuration security session is open and configuration is not locked (LOCK_CFG register equals to 0).
Table 5. System configuration memory map for registers accessed through dedicated commands
RF access |
|
|
Static Register |
|
Address |
Type |
|
Name |
Function |
|
|
|
|
|
N/A |
WO (1) |
Table 25. LOCK_DSFID |
DSFID lock status |
|
N/A |
WO (2) |
Table 26. LOCK_AFI |
AFI lock status |
|
N/A |
WO(1) |
Table 27. DSFID |
DSFID value |
|
N/A |
WO(2) |
Table 28. AFI |
AFI value |
|
N/A |
RO |
Table 29. IC_REF |
IC reference value |
|
|
|
|
|
|
N/A |
RO |
Table 30. |
UID |
Unique identifier, 8 bytes |
|
|
|
|
|
N/A |
WO (3) |
Table 7. PWD_KILL |
Kill or untraceable password, 4 bytes |
|
N/A |
WO (4) |
Table 12. |
PWD_A1 |
User Area 1 security session password, 4 bytes |
N/A |
WO(3) |
Table 13. |
PWD_A2 |
User Area 2 security session password, 4 bytes |
N/A |
WO(3) |
Table 11. PWD_CFG |
Configuration security session password, 4 bytes |
1.Write access if DSFID is not locked
2.Write access if AFI is not locked.
3.Write access only if not locked.
4.Write access only if corresponding security session is open.
DS12074 - Rev 11 |
page 9/90 |
|
|
ST25TV02K ST25TV512
5ST25TV02K/512 specific features
ST25TV02K/512 offer the data protection feature, both user memory and system configuration, a kill mode, and a untraceable mode.
Those features can be programmed by setting registers of the ST25TV02K/512. ST25TV02K/512 can be partially customized using configuration registers located in the EEPROM system area.
These registers are dedicated to:
•Data Memory organization and protection AiSS, LOCK_BLOCK.
•Kill mode, KILL
•The device’s structure LOCK_CFG
•Electronic Article Surveillance (EAS)
•TruST25™ digital signature
•Counter
•Tamper Detect
•Random Number generation
•Untraceable mode
A set of additional registers allows to identify and customize the product (DSFID, AFI, IC_REF, etc.).
Dedicated commands Read Configuration and Write Configuration must be used to access the configuration registers. Update is only possible when the access right has been granted by presenting the configuration password (PWD_CFG), and if the system configuration was not previously locked (LOCK_CFG=1).
After any valid write access to the configuration registers, the new configuration is immediately applied.
Table 6. KILL
RF |
Command |
Kill (cmd code A6h) UID @00h |
|
|
|
|
|
Type |
WO if PWD_KILL is correctly presented in the Kill command. |
|
|
|
|
||
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
N/A |
KILL_MUTE |
Status of the KILL feature |
Inactive |
|
|
|
|
Table 7. PWD_KILL
|
RF |
Command |
Write pswd (cmd code B1h) with pswd_id = 0h |
|
|
|
|
|
|
|
Type |
WO: only possible if PWD_KILL is not locked. |
|
|
|
|
|
||
|
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
b31-b0 |
KILL_PSWD |
Password value for kill feature or untraceable mode |
00000000h |
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands . |
DS12074 - Rev 11 |
page 10/90 |
|
|
ST25TV02K ST25TV512
KILL register allows the user to permanently kill the ST25TV02K/512 tag. Two working modes are offered by ST25TV02K/512:
•Kill mute mode:
–When KILL_MUTE is set with the Kill command code, the ST25TV02K/512 are killed. They can not be read or written and stays mute to any request. Kill mute mode is definitive.
•Normal mode:
–In normal usage, KILL_MUTE is set to 0, ST25TV02K/512 will process the request and respond accordingly.
The Kill Password PWD_KILL must be presented in the Kill command for setting the Kill Mute mode.
Kill Password lock
By default, the Kill password is not write protected. The kill password can be locked with Lock kill (cmd code B2h). For safe operation, it is recommended to change the default value of the Kill Password and lock it even if not used in the final product
When not used in an end application, a random value should be written into the KILL_PWD and the KILL_PWD should be locked with Lock kill.
5.2Data protection
ST25TV02K/512 provide a special data protection mechanism based on encrypted passwords that unlock security sessions.
User memory can be protected for read and/or write access and system configuration can be protected from write access. User memory can also be permanently locked. Each block can be independently locked from each other with the Lock block command (refer to Section 6.4.8 Lock block).
Table 8. A1SS
|
Command |
Read Configuration (cmd code A0h) @00h |
|
|
RF |
Write Configuration (cmd code A1h) @00h |
|
||
|
|
|||
|
|
|
|
|
|
Type |
R always, W if configuration security session is open and configuration not locked |
||
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
Area 1 access rights: |
|
|
|
|
00: Area 1 access: Read is always allowed / Write always allowed |
|
|
|
|
01: Area 1 access: Read is always allowed and if user security |
|
|
|
|
session is open (i.e. the proper area 1 password has been presented), |
|
|
b1-b0 |
RW_PROTECTION_A1 |
write is allowed. |
00b |
|
10: Area 1 access: Read and Write are allowed only if user security |
||||
|
|
|
||
|
|
session is open (the proper area 1 password has been presented). |
|
|
|
|
11: Area 1 access: Read is allowed only if user security session is |
|
|
|
|
open (the proper area 1 password has been presented). Write is |
|
|
|
|
always forbidden. |
|
|
|
|
|
|
|
b2 |
MEM_ORG |
0: memory is split in three areas (Areas 0, 1 and 2) |
1b |
|
1: memory is composed of two areas (Areas 0 and 1) |
||||
|
|
|
||
|
|
|
|
|
b7-b3 |
RFU |
- |
00000b |
|
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands |
DS12074 - Rev 11 |
page 11/90 |
|
|
|
|
ST25TV02K ST25TV512 |
||
|
|
|
Data protection |
|
|
|
|
|
|
|
|
Table 9. A2SS |
|
|
|
|
|
|
|
|
Command |
Read Configuration (cmd code A0h) @01h |
|
|
RF |
Write Configuration (cmd code A1h) @01h |
|
||
|
|
|||
|
|
|
|
|
|
Type |
R always, W if configuration security session is open and configuration not locked |
||
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
Area 2 access rights: |
|
|
|
|
00: Area 2 access: Read and write are always allowed |
|
|
|
|
01: Area 2 access: Read is always allowed, and if the user |
|
|
|
|
security session is open (i.e. the proper Area 2 password has been |
|
|
b1-b0 |
RW_PROTECTION_A2 |
presented), then write is allowed. |
00b |
|
10: Area 2 access: Read and Write are allowed only if the user |
||||
|
|
|
||
|
|
security session is open (the proper Area 2 password has been |
|
|
|
|
presented) |
|
|
|
|
11: Area 2 access: Read is allowed only if user security session is |
|
|
|
|
open (the proper Area 2 password has been presented). Write is |
|
|
|
|
always forbidden. |
|
|
|
|
|
|
|
b7-b2 |
RFU |
- |
000000b |
|
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands |
|||
|
|
Table 10. LOCK_CFG |
|
|
|
|
|
|
|
|
Command |
Read Configuration (cmd code A0h) @06h |
|
|
|
Write Configuration (cmd code A1h) @06h |
|
||
|
|
|
||
RF |
|
|
|
|
|
R: always possible |
|
||
|
|
|
||
|
Type |
W: if RF configuration security session is open (configuration password has been presented |
||
|
|
before) and configuration not locked |
|
|
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
0: Configuration is unlocked (configuration registers can be written) |
|
|
b0 |
LCK_CFG |
1: Configuration is locked (configuration registers are definitively |
0b |
|
|
|
locked) |
|
|
|
|
|
|
|
b7-b1 |
RFU |
- |
0000000b |
|
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands |
|||
|
|
Table 11. PWD_CFG |
|
|
|
|
|
|
|
|
Command |
Write pswd (cmd code B1h) with pswd_id = 3h |
|
|
|
|
|
||
RF |
Type |
WO: if RF configuration security session is open (configuration password has been presented |
||
|
before). If the configuration is locked, and the EAS configuration is protected by password, the |
|||
|
|
new PWD_CFG value is only applicable to the EAS configuration. |
|
|
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
b31-b0 |
CFG_PSWD |
Password value for configuration area |
00000000h |
|
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands |
DS12074 - Rev 11 |
page 12/90 |
|
|
|
|
ST25TV02K ST25TV512 |
||
|
|
|
Data protection |
|
|
|
|
|
|
|
|
Table 12. PWD_A1 |
|
|
|
|
|
|
|
RF |
Command |
Write pswd (cmd code B1h) with pswd_id = 1h |
|
|
|
|
|
||
Type |
WO: if RF area 1 security session is open (area 1 password has been presented before). |
|||
|
||||
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
When MEM_ORG=0: Password value for user area 1 |
|
|
b31-b0 |
A1_PSWD |
When MEM_ORG=1: 32 least significant bits of the 64-bit Password |
00000000h |
|
|
|
value for user area 1 |
|
|
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands |
|||
|
|
Table 13. PWD_A2 |
|
|
|
|
|
|
|
|
Command |
Write pswd (cmd code B1h) with pswd_id = 2h |
|
|
RF |
|
|
|
|
Type |
WO: if RF area 2 security session is open (area 2 password has been presented before). Only |
|||
|
||||
|
applicable to the case of MEMORG=0 |
|
||
|
|
|
||
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
When MEM_ORG=0: Password value for user area 2 in case of three |
|
|
|
|
area memory setup |
|
|
b31-b0 |
A2_PSWD |
When MEM_ORG=1: 32 most significant bits of area 1 password in |
00000000h |
|
|
|
case of two area memory setup |
|
|
|
|
(in this last case area 1 password is 64-bit long) |
|
|
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands . |
ST25TV02K/512 provide protection of user memory and system configuration registers. The users can access those protected data by opening security sessions with the help of passwords. Access rights are more restricted when security sessions are closed, and less restricted when security sessions are open.
There are two types of security sessions, as shown in Table 14:
Table 14. Security session type
Security session |
Open by presenting |
Right granted when security session is open, and until it is |
|
closed |
|||
|
|
||
|
|
|
|
user |
password Area 1, Area 2 |
user access to protect user memory as defined in AiSS registers |
|
(PWD_A1, PWD_A2) |
user write access to password A1 or A2(1) |
||
|
|||
configuration |
Configuration password |
user write access to configuration registers |
|
(PWD_CFG) |
|||
|
|
||
|
|
|
1. Write access to the password number corresponding to the password number presented.
In a three areas set up (MEM_ORG set at 0), each of the User Area 1 and 2 passwords is 32-bits long, and default factory passwords value is 00000000h.
In a two areas setup (MEM_ORG set at 1), User Area 1 password is 64-bits long, and default factory password value is 0000000000000000h.
The ST25TV02K/512 passwords management is organized around dedicated set of commands to access the dedicated registers in system configuration area.
The dedicated password commands are:
• |
Write Password command (code B1h): See Section 6.4.20 Write Password. |
• |
Present Password command (code B3h): See Section 6.4.21 Present Password |
User possible actions for security sessions are:
DS12074 - Rev 11 |
page 13/90 |
|
|
ST25TV02K ST25TV512
Data protection
•Open user security session: Present Password command, with password identifier 1 for PWD_A1 and 2 for PWD_A2 for three areas configuration or identifier 1 for PWD_A1 for two areas configuration, and the valid corresponding password
•Write password:
–When MEMORG=0:
Present Password command, with password identifier 1 for PWD_A1 and 2 for PWD_A2 and the current valid corresponding password. Then Write Password command, with same password number (1 or 2) and the new corresponding password.
–When MEMORG=1:
present PWD_A1 (64 bits), then Write Password command with PWD_A1 and then PWD_A2
•Close user security session: Present Password command, with a different password number than the one used to open session or any wrong password. Or remove tag from RF field (POR).
•Open configuration security session: Present Password command, with password number 3 and the valid password PWD_CFG.
•Close configuration security session: Present Password command, with a password number different than 3, or password number 3 and wrong password PWD_CFG. Or remove tag from field (POR).
Opening any new security session (user or configuration) automatically close the previously open one (even if it fails).
Figure 6. Security sessions management
Present any password not OK
ST25TVxxx out of RF field
Field ON |
Field OFF |
|
All security |
Any other |
sessions |
command |
closed |
Present
PWD_x OK
|
|
|
|
|
|
|
|
Security |
|||
|
|
|
|
|
|
|
|
||||
Any other |
|
|
|
|
|
|
session x |
||||
|
|
|
|
|
|
opened |
|||||
command |
|
|
|
|
|
|
(y closed) |
|
|||
|
|
|
|
|
|
|
|||||
Present |
|
|
|
Present |
|||||||
|
|
|
|||||||||
PWD_x OK |
|
|
PWD_y OK |
||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Security |
|||
|
|
|
|
|
|
|
|
||||
Any other |
|
|
|
|
|
|
|
session y |
|||
|
|
|
|
|
|
|
opened |
|
|||
command |
|
|
|
|
|
|
|
(x closed) |
|||
|
|
|
|
DS12074 - Rev 11 |
page 14/90 |
|
|
ST25TV02K ST25TV512
Data protection
On factory delivery, areas are not protected.
Each area can be individually protected in read and/or write access. Area 0 is always readable.
Furthermore, Area 0 can be independently write locked.
Each memory area can also have individual Read/Write access conditions. For each area 1 and 2, an AiSS register is used to:
• Select the protection against read and write operations for this area
(See Table 8. A1SS, and Table 9. A2SS for details about available read and write protections).
When updating AiSS registers, the new protection value is effective immediately after the register write completion.
•Block 0 is an exception to this protection mechanism:
–Block 0 can be individually write locked by issuing a Lock Single Block command. Once locked, it cannot be unlock.
–User needs no password to lock block 0.
–Locking block 0 is possible even if the configuration is locked (LOCK_CFG=1).
–Unlocking Area 1 (through A1SS register) does not unlock block 0 if it has been locked though Lock Block command.
–Once locked, the user cannot unlock block 0.
•Other blocks can be individually locked.
Retrieve the security status of a user memory block or byte
User can read a block security status by issuing following commands:
•Get Multiple Blocks Security Status command
•(Fast) Read Single Block with option flag set to 1
•(Fast) Read Multiple Blocks with option flag set to 1
•(Fast) Inventory Read
ST25TV02K/512 responds with a Block security status containing a Lock_bit flag as specified in ISO 15693 standard. This lock_bit flag is set to 1 if block is locked against write.
Lock_bit flag value may vary if corresponding user security session is open or closed.
By default, the system memory is write protected, except the kill password and the EAS settings.
Th system memory consists of all the registers defined in Table 4. System configuration memory map accessible through write_cfg and read_cfg commands. Some registers are read-only and can never be written.
To enable write access to system configuration registers, which have write capability, user must open the configuration security session (by presenting a valid password 3) and system configuration must not be locked (LOCK_CFG=00h).
By default, user can read all system configuration registers, except all passwords, LOCK_DSFID and LOCK_AFI. Configuration lock:
•Write access to system configuration registers can be locked by writing 01h in the LOCK_CFG register.
•User cannot unlock system configuration if LOCK_CFG=01h, even after opening configuration security session (Lock is definitive).
•When system configuration is locked (LOCK_CFG=01h), it is still possible to change passwords (0 to 3).
Device identification registers:
•AFI and DFSID registers can be independently locked by user, issuing respectively a Lock AFI and a Lock DSFID command. Lock is definitive: once locked, AFI and DSFID registers cannot be unlocked.
•Other device identification registers (MEM_SIZE, BLK_SIZE, IC_REF, UID) are read only registers.
DS12074 - Rev 11 |
page 15/90 |
|
|
ST25TV02K ST25TV512
5.3Untraceable mode
|
|
|
Table 15. Untraceable mode register |
|
|
|
|
|
|
|
|
|
|
Command |
|
Enable untraceable mode (cmd code BAh) with pswd_id = 0h |
|
|
RF |
|
|
|
|
|
Type |
|
WO : only possible if untraceable mode password has been written before, always |
||
|
|
|
|||
|
|
|
writable otherwise |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Bit |
Name |
|
Function |
Factory value |
|
|
|
|
|
|
|
b31-b0 |
UNTRACEABLE |
|
Password value for feature untraceable mode |
00000000h |
|
_MODE_PSWD |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
||||
|
untraceable mode register. |
|
|
|
With the EnableUntraceableMode command, the ST25TV02K/512 do not respond to any command except Present Password and Get Random Number, guaranteeing the untraceability to customer requests.
The EnableUntraceableMode command requires the untraceable access code (fixed value) and the crypted untraceable mode password to be presented for ST25TV02K/512 to enter into this mode.
To get out of the mode, the valid crypted untraceable mode password has to be transmitted to ST25TV02K/512 with the Present password command. The crypted untraceable mode password is obtained from the random number and the untraceable mode password as explained in AN5103 "Password encryption for ST25TV512 and ST25TV02K devices", available on www.st.com. When not used in an end application, a random value must be written into the KILL_PWD password, and the KILL_PWD must be locked with Lock kill.
Table 16. Random number register
|
RF |
Command |
Get random number (cmd code B4h) |
|
|
|
|
|
|
|
Type |
RO: is only possible with Get random number command. |
|
|
|
|
|
||
|
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
b15-b0 |
RANDOM_NUMBER |
16-bit random number generated by ST25TV02K/512 |
N/A |
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
|||
|
random number register. |
|
|
The GET_RANDOM_NUMBER returns a 16-bit random number.
DS12074 - Rev 11 |
page 16/90 |
|
|
ST25TV02K ST25TV512
5.5Electronic article surveillance (EAS)
|
|
Table 17. EAS_SEC |
|
|
|
|
|
|
Command |
Read Configuration (cmd code A0h) @02h |
|
|
Write Configuration (cmd code A1h) @02h |
|
|
|
|
|
|
|
|
|
|
|
|
R: always possible |
|
|
Type |
W: if RF configuration security session is open (the proper configuration password has been |
|
|
|
presented before) and configuration not locked |
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
EAS security write protection: |
|
|
|
0: EAS parameters are always writable |
|
b0 |
W_PROTECTION_EAS |
1: EAS parameters are write protected by configuration password. |
0b |
|
|
In case of lock_EAS command has been previously used, this bit is |
|
|
|
don’t care and EAS parameters are non-writable. |
|
|
|
|
|
b7-b1 |
RFU |
- |
0000000b |
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands for |
||
|
the AES security activation register. |
|
|
|
Table 18. EAS_TELEGRAM register |
|
|
|
|
|
|
|
Enable EAS (cmd code A5h) with option flag set to 0 |
|
|
Command |
Enable EAS (cmd code A5h) with option flag set to 1 and mask length ≠ 00h and EAS_ID |
|
|
Write Single (cmd code 21h) to Blocks [248 to 255] (1) |
|
|
|
|
|
|
RF |
|
Read Single blocks at @248 to 255 returns an error. |
|
|
|
|
|
|
|
R: possible with enable EAS command only if set EAS command has been presented before |
|
|
Type |
W: possible under conditions set in the EAS_SEC configuration register and EAS |
|
|
|
configuration not locked |
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
b255-b0 |
EAS_TELEGRAM |
Electronic article surveillance telegram. |
All bits = 0b |
|
|
|
|
1. Write Single Block at addresses 248 to 255 correspond to EAS blocks 1 to 8 respectively.
5.5.2EAS ID
Table 19. EAS_ID
|
Command |
Enable EAS (cmd code A5h) with option flag set to 1 and mask length set to 0h |
|
|
Write EAS ID (cmd code A7h) |
|
|
|
|
|
|
RF |
|
|
|
|
R: possible with enable EAS command only if set EAS command has been presented before |
||
|
|
||
|
Type |
W: possible under conditions set in the EAS_SEC configuration register and EAS |
|
|
|
configuration not locked |
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
b15-b0 |
EAS_ID |
Electronic article surveillance identifier value. |
0000h |
|
|
|
|
DS12074 - Rev 11 |
page 17/90 |
|
|
ST25TV02K ST25TV512
Electronic article surveillance (EAS)
|
|
Table 20. EAS_CFG |
|
|
|
|
|
|
|
Enable EAS (cmd code A5h) with option flag set to 1 and mask length ≠ 00h and EAS_ID, or |
|
|
Command |
with option flag set to 0 |
|
RF |
|
Write EAS config (cmd code A8h) |
|
|
|
|
|
|
Type |
WO: possible under conditions set in the EAS_SEC configuration register and configuration |
|
|
not locked |
|
|
|
|
|
|
|
|
|
|
Bit |
Name |
Function |
Factory value |
|
|
|
|
|
|
Electronic article surveillance identifier configuration: |
|
|
|
00: 256 bit payload (EAS block 1 to 8) |
|
b1-b0 |
EAS_CFG |
01: 128 bit payload (EAS block 1 to 4) |
00h |
|
|
10: 64 bit payload (EAS block 1 to 2) |
|
|
|
11: 32 bit payload (EAS block 1) |
|
|
|
|
|
b15-b2 |
RFU |
- |
000000b |
|
|
|
|
The EAS parameters (ID, Telegram, mode (set/reset) can be definitely locked with the Lock EAS command (refer to Section 6.4.27 Lock EAS).
The EAS (electronic article surveillance) feature is mainly used for library management, applications, requiring an anti-theft protection.
This is programmable and configured by custom commands and optionally protected by the configuration password (when programming EAS_SEC to 1) and can be locked.
A telegram can be stored using standard write command depending of its configured length (EAS block 1 – EAS Block 8).
The EAS feature can be activated, reset, locked using a set of custom commands (see Section 6.4.24 Set EAS, Section 6.4.25 Reset EAS, Section 6.4.26 Enable EAS, Section 6.4.27 Lock EAS, Section 6.4.28 Write EAS ID and Section 6.4.29 Write EAS CONFIG).
The EAS feature is reset (deactivated) by default.
DS12074 - Rev 11 |
page 18/90 |
|
|
ST25TV02K ST25TV512
Electronic article surveillance (EAS)
Figure 7. Nominal EAS operation
RF Reader |
ST25TV |
EAS – Normal
operation
Write Single (EAS, EAS block x)
Write EAS config
Optional
step
Write EAS ID
Set EAS
Lock EAS
Enable EAS (selective ID or none)
If selected: EAS ID or telegram
Reset EAS (if not locked)
EAS deactivated (reset)
Repeated based on EAS telegram size
EAS ready
EAS deactivated (reset)
By default, the EAS configuration (EAS telegram, EAS ID, EAS configuration, lock EAS, EAS mode) is not write protected.
The EAS configuration can be write protected by the configuration password (PWD_CFG) by writing 1b1 into the W_PROTECTION_EAS (EAS_SEC register). If W_PROTECTION_EAS bit is set, the EAS configuration can be changed only if the configuration password has been presented just before in the same RF session.
Write access to the EAS configuration can be locked by executing the lock_EAS command. User cannot unlock system configuration if the EAS configuration has already been locked earlier with the Lock_EAS command, even after opening configuration security session (Lock is definitive).
DS12074 - Rev 11 |
page 19/90 |
|
|
ST25TV02K ST25TV512
5.6TruST25 digital signature
ST25TV02K/512 support TruST25 digital signature, a feature that allows to verify the authenticity of the device, based on a unique digital signature.
TruST25 solution encompasses secure industrialization processes and tools deployed by STMicroelectronics to generate, store and check the signature in the device.
Table 21. KID
|
Command |
Read Cfg (cmd code A0h) @7h |
|
|
|
|
|
|
|
Bit |
Type |
RO |
|
|
|
|
|
|
|
|
Name |
Function |
Factory value |
|
|
|
|
|
|
b7-b0 |
KID |
Contains a key identifier used for TruST25 digital signature |
ST key number |
|
identification and possible revocation. |
||||
|
|
|
||
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands for |
|||
|
the KID register. |
|
|
Counter configuration
Table 22. CNT_CFG
|
Command |
Read Cfg (cmd code A0h) @3h |
|
|
|
Write Cfg (cmd code A1h) @3h |
|
||
|
|
|
||
|
|
|
|
|
Bit |
|
R: always possible |
|
|
Type |
W: if RF configuration security session is open (the proper configuration password has been |
|||
|
||||
|
|
presented before) and configuration not locked. |
|
|
|
|
|
|
|
|
Name |
Function |
Factory value |
|
|
|
|
|
|
|
|
Counter enable |
|
|
b0 |
CNT_EN |
0: counter is disabled |
0b |
|
1: counter is enabled on successful write operation (one increment |
||||
|
|
|
||
|
|
per RF session) |
|
|
|
|
|
|
|
|
|
Counter clear: |
|
|
b1 |
CNT_CLR |
0: don’t care |
0b |
|
1: counter is cleared and automatically disabled (CNT_EN is put to 0) |
||||
|
|
|
||
|
|
This bit is self-cleared |
|
|
|
|
|
|
|
b7-b2 |
RFU |
- |
000000b |
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands for |
|
|
the CNT_CFG register. |
|
|
Counter value |
|
|
|
Table 23. CNT_VAL |
|
|
|
Bit |
Command |
Read Cfg (cmd code A0h) @4h |
|
|
|
DS12074 - Rev 11 |
page 20/90 |
|
|
|
|
|
ST25TV02K ST25TV512 |
|
|
|
|
|
Inventory Read |
|
|
|
|
|
|
|
|
|
|
Bit |
Type |
RO |
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
b15-b0 |
CNT_VAL |
Counter value |
|
0h |
|
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands for |
|||
|
the CNT_VAL register. |
|
|
|
A 16 bits counter can track the write events on the NDEF file.
It benefits from an anti-tearing mechanism that ensures the consistency of the counter, even if there is an electrical problem during its increment.
The value of the counter (CNT_VAL) can be checked by any application, by reading the Counter register.
If enabled (when CNT_EN = 1), the Write counter will be incremented on first successful Write event which is performed in the user area, inside an RF session (an RF session is entered when ST25TV02K/512 receive
enough power from the RF field). After enabling the counter, the counter will not count until the next RF field on/off cycle.
The default configuration is with a counter disabled.
The counter cannot be locked. When the counter reach its maximum (216-1) the increment mechanism is blocked. The counter is cleared and automatically disabled when CNT_CLR is set to 1.
Apart from these procedures, there is no way to act on the value of this counter.
The Read/Write counter can be configured through the Counter Configuration register. This Counter Configuration register allows to:
•Enable or disable this counter (CNT_EN)
•Clear the counter (CNT_CLR)
The Counter Configuration register is protected by the configuration password.
5.8Inventory Read
ST25TV02K/512 have the ability to perform in a single command Inventory Read (Refer to
Section 6.4.37 Inventory read), an Inventory in accordance with the regular anticollision sequence followed by a Multiple Block Read, reducing the overall communication time. ST25TV02K/512 return the requested memory content if ST25TV02K/512 match the mask specified in the command.
When using the Fast Inventory Read (refer to Section 6.4.38 Fast inventory read), the response is twice the data rate.
ST25TV02K/512 provide a special feature to improve the inventory time response of moving tags using the Initiate_flag value. This flag, controlled by the Initiate command (refer to Section 6.4.36 Initiate), allows tags to answer to Inventory Initiated commands (refer to Section 6.4.35 Inventory Initiated).
For applications where multiple tags are moving in front of a reader, it is possible to miss tags using the standard inventory command. The reason is that the inventory sequence has to be performed on a global tree search. For example, a tag with a particular UID value may have to wait the run of a long tree search before being inventoried. If the delay is too long, the tag may be out of the field before it has been detected.
Using the Initiate command, the inventory sequence is optimized. When multiple tags are moving in front of a reader, the ones which are within the reader field will be initiated by the Initiate command. In this case, a small batch of tags will answer to the Inventory Initiated command which will optimize the time necessary to identify all the tags. When finished, the reader has to issue a new Initiate command in order to initiate a new small batch of tags which are new inside the reader field.
It is also possible to reduce the inventory sequence time using the Fast Initiate (refer to Section 6.4.34 Fast Initiate), and Fast Inventory Initiated commands (refer to Section 6.4.33 Fast Inventory Initiated). These commands allow the ST25TV02K/512 to increase their response data rate by a factor of 2, up to 53 kbit/s.
DS12074 - Rev 11 |
page 21/90 |
|
|
ST25TV02K ST25TV512
5.10Tamper detect
Tamper detection
Table 24. TAMPER_DETECT
|
Command |
Read Cfg (cmd code A0h) @5h |
|
|
|
|
|
Bit |
Type |
RO |
|
|
|
|
|
|
Name |
Function |
Factory value |
|
|
|
|
|
|
State of Tamper: |
|
b0 |
TAMPER_DETECT |
0: loop is open. Tamper is detected |
0b |
|
|
1: loop is closed. No tamper is detected |
|
|
|
|
|
b7-b1 |
RFU |
- |
000000b |
|
|
|
|
Note: |
Refer to Table 4. System configuration memory map accessible through write_cfg and read_cfg commands for |
||
|
the TAMPER_DETECT register. |
|
The Tamper detection allows to check the shortage between the 2 TD0 and TD1 pins of the ST25TV02K/512.
This state TAMPER_DETECT is captured by ST25TV02K/512 each time that the ST25TV02K/512 are powered and available upon demand by the reader using the Read Cfg command with CFG_ID 5. (Tamper detection) This information will be lost during power off. (No permanent storage of the status.)
This is the customer responsibility to check the register status and behave accordingly. The short impedance should be less than 50 Ω.
The tamper detect feature is available for the ST25TV02K/512-AD devices only. On other configurations, a Read Cfg of the Tamper Detection register will return an error code.
If the two inputs pins TD0, TD1 are shorted with a wire at the time RF field is turned on, the tamper register will have a value “1”. If TD0, TD1 are not shorted at the time RF field is turned on, the tamper register will have a value “0”.
Table 25. LOCK_DSFID
|
Command |
Lock DSFID (cmd code 2Ah) |
|
|
|
|
|
|
|
Bit |
Type |
WO if DSFID not locked |
|
|
|
|
|
|
|
|
Name |
Function |
Factory value |
|
|
|
|
|
|
b0 |
LOCK_DSFID |
0: DSFID is not locked |
0b |
|
1: DSFID is locked |
||||
|
|
|
||
|
|
|
|
|
b7-b1 |
RFU |
- |
0000000b |
|
|
|
|
|
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
||
|
LOCK_DSFID register. |
|
|
|
|
|
Table 26. LOCK_AFI |
|
|
|
|
|
Bit |
Command |
Lock AFI (cmd code 28h) |
|
|
|
|
DS12074 - Rev 11 |
page 22/90 |
|
|
|
|
|
|
|
ST25TV02K ST25TV512 |
|
|
|
|
|
|
Device parameter registers |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Bit |
|
Type |
WO if AFI not locked |
|
|
|
|
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
|
|
|
b0 |
|
LOCK_AFI |
0: AFI is not locked |
|
0b |
|
|
1: AFI is locked |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
b7-b1 |
|
RFU |
- |
|
0000000b |
|
|
|
|
|
||
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
|||||
|
LOCK_AFI register. |
|
|
|
|
|
|
|
|
|
Table 27. DSFID |
|
|
|
|
|
|
|
|
|
|
|
|
|
Inventory (cmd code 01h) |
|
|
|
|
|
Command |
Get System Info (cmd code 2Bh) |
|
|
|
Bit |
|
|
Write DSFID (cmd code 28h) |
|
|
|
|
|
|
|
|
|
|
|
|
Type |
R always, W if DSFID not locked |
|
|
|
|
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
|
|
|
b7-b0 |
|
DSFID |
ISO/IEC 15693 Data Storage Format Identifier |
|
00h |
Note: |
|
|
|
|
||
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
||||||
|
DSFID register. |
|
|
|
|
|
|
|
|
|
Table 28. AFI |
|
|
|
|
|
|
|
|
|
|
|
|
|
Inventory (cmd code 01h) |
|
|
|
|
|
Command |
Get System Info (cmd code 2Bh) |
|
|
|
Bit |
|
|
Write AFI (cmd code 27h) |
|
|
|
|
|
|
|
|
|
|
|
|
Type |
R always, W if AFI not locked |
|
|
|
|
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
|
|
|
b7-b0 |
|
AFI |
ISO/IEC 15693 Application Family Identifier |
|
00h |
|
|
|
|
|
||
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
|||||
|
AFI register. |
|
|
|
|
|
|
|
|
|
Table 29. IC_REF |
|
|
|
|
|
|
|
|
|
|
|
|
Command |
Get System Info (cmd code 2Bh) |
|
|
|
Bit |
|
|
|
|
|
|
|
Type |
RO |
|
|
|
|
|
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
|
|
|
b7-b0 |
|
IC_REF |
ISO/IEC 15693 IC Reference |
|
45h |
|
|
|
|
|
||
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
|||||
|
IC_REF register. |
|
|
|
|
|
|
|
|
|
Table 30. UID |
|
|
|
|
|
|
|
|
|
|
|
|
Command |
Inventory (cmd code 01h) |
|
|
|
|
|
Get System Info (cmd code 2Bh) |
|
|
|
|
Bit |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Type |
RO |
|
|
|
|
|
|
|
|
||
|
|
|
|
|
|
|
|
|
|
Name |
Function |
|
Factory value |
|
|
|
|
|
|
|
DS12074 - Rev 11 |
page 23/90 |
|
|
ST25TV02K ST25TV512
Device parameter registers
|
b7-b0 |
|
|
ISO/IEC 15693 UID byte 0 (LSB) |
|
|
|
|
|
|
|
|
|
|
b7-b0 |
|
|
ISO/IEC 15693 UID byte 1 |
|
|
|
|
|
|
|
|
IC manufacturer |
|
b7-b0 |
|
|
ISO/IEC 15693 UID byte 2 |
||
|
|
|
serial number |
|||
|
|
|
|
|
|
|
|
b7-b0 |
|
UID |
ISO/IEC 15693 UID byte 3 |
|
|
|
|
|
|
|
|
|
|
b7-b0 |
|
ISO/IEC 15693 UID byte 4 |
|
||
|
|
|
|
|||
|
|
|
|
|
|
|
|
b7-b0 |
|
|
ISO/IEC 15693 |
UID byte 5: ST Product code |
23h |
|
|
|
|
|
|
|
|
b7-b0 |
|
|
ISO/IEC 15693 |
UID byte 6: IC Mfg code |
02h |
|
|
|
|
|
|
|
|
b7-b0 |
|
|
ISO/IEC 15693 |
UID byte 7 (MSB) |
E0h |
|
|
|
|
|
||
Note: |
Refer to Table 5. System configuration memory map for registers accessed through dedicated commands for the |
|||||
|
UID register. |
|
|
|
|
DS12074 - Rev 11 |
page 24/90 |
|
|
ST25TV02K ST25TV512
6RF operations
Contactless exchanges are performed as specified by ISO/IEC 15693 and NFC Forum Type 5. The ST25TV02K/512 communicate via the 13.56 MHz carrier electromagnetic wave on which incoming data are demodulated from the received signal amplitude modulation (ASK: amplitude shift keying). The received ASK wave is 10% or 100% modulated with a data rate of 1.6 Kbit/s using the 1/256 pulse coding mode or a data rate of 26 Kbit/s using the 1/4 pulse coding mode.
Outgoing data are generated by the ST25TV02K/512 load variation using Manchester coding with one or two subcarrier frequencies at 423 kHz and 484 kHz. Data are transferred from the ST25TV02K/512 at 6.6 Kbit/s in low data rate mode and 26 Kbit/s in high data rate mode. The ST25TV02K/512 support the 53 Kbit/s data rate mode in one sub-carrier frequency at 423 kHz.
The ST25TV02K/512 follow ISO/IEC 15693 and NFC Forum Type 5 recommendation for radio-frequency power and signal interface and for anticollision and transmission protocol.
The dialog between the “reader” and the ST25TV02K/512 take place as follows:
These operations use the power transfer and communication signal interface described below (see Power transfer, Frequency and Operating field). This technique is called RTF (Reader talk first).
•Activation of the ST25TV02K/512 by the operating field of the reader,
•Transmission of a command by the reader (ST25TV02K/512 detect carrier amplitude modulation)
•Transmission of a response by the ST25TV02K/512 (ST25TV02K/512 modulate is load clocked at subcarrier rate)
Operating field
The ST25TV02K/512 operate continuously between the minimum and maximum values of the electromagnetic field H defined in Table 153. RF characteristics. The Reader has to generate a field within these limits.
Power transfer
Power is transferred to the ST25TV02K/512 by radio frequency at 13.56 MHz via coupling antennas in the ST25TV02K/512 and the Reader. The operating field of the reader is transformed on the ST25TV02K/512 antenna to an AC voltage which is rectified, filtered and internally regulated. During communications, the amplitude modulation (ASK) on this received signal is demodulated by the ASK demodulator.
Frequency
The ISO 15693 standard defines the carrier frequency (fC) of the operating field as
13.56 MHz ± 7 kHz.
The transmission protocol (or simply “the protocol”) defines the mechanism used to exchange instructions and data between the VCD (Vicinity Coupling Device) and the VICC (Vicinity integrated circuit card) in both directions. It is based on the concept of “VCD talks first”. The ST25TV02K/512 act as the VICC.
This means that a ST25TV02K/512 do not start transmitting unless it has received and properly decoded an instruction sent by the VCD. The protocol is based on an exchange of:
•a request from the VCD to the ST25TV02K/512,
•a response from the ST25TV02K/512 to the VCD.
DS12074 - Rev 11 |
page 25/90 |
|
|
ST25TV02K ST25TV512
RF protocol description
Each request and each response are contained in a frame. The frames are delimited by a Start of Frame (SOF) and End of Frame (EOF).
The protocol is bit-oriented. The number of bits transmitted in a frame is a multiple of eight (8), that is an integer number of bytes.
A single-byte field is transmitted least significant bit (LSBit) first. A multiple-byte field is transmitted least significant byte (LSByte) first and each byte is transmitted least significant bit (LSBit) first.
Figure 8. ST25TV02K/512 protocol timing
VCD |
Request |
|
|
|
|
|
|
|
|
|
Request |
|
|
|
|
|
|
|
|
|
frame |
|
|
|
|
|
|
|
|
|
frame |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ST25TV02K/512 |
|
|
|
|
|
Response |
|
|
|
|
|
|
|
|
|
Response |
|
|
|
|
|
|
|
|
|
frame |
|
|
|
|
|
|
|
|
|
frame |
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
Timing |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
t1 |
|
|
|
t2 |
|
t1 |
|
|
t2 |
|||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
The ST25TV02K/512 can be in one of four states:
•Power-off
•Ready
•Quiet
•Selected
Transitions between these states are specified in Figure 9. state transition diagram and Table 31. response depending on Request_flags.
Power-off state
The ST25TV02K/512 are in the power-off state when it does not receive enough energy from the VCD.
Ready state
The ST25TV02K/512 are in the Ready state when it receives enough energy from the VCD. When in the Ready state, the ST25TV02K/512 answer any request where the Select_flag is not set.
Quiet state
When in the Quiet state, the ST25TV02K/512 answer any request with the Address_flag set, except for Inventory requests.
Selected state
In the Selected state, the ST25TV02K/512 answer any request in all modes (see Section 6.2.3 Modes):
•Request in Select mode with the Select_flag set
•Request in Addressed mode if the UID matches
•Request in Non-Addressed mode as it is the mode for general requests
DS12074 - Rev 11 |
page 26/90 |
|
|
ST25TV02K ST25TV512
RF protocol description
Table 31. response depending on Request_flags
|
Address_flag |
Select_flag |
|||
Flags |
1 |
0 |
1 |
0 |
|
|
Addressed |
Non addressed |
Selected |
Non selected |
|
|
|
|
|
|
|
ST25TV02K/512 in Ready or Selected state (Devices in Quiet state |
- |
X |
- |
X |
|
do not answer) |
|||||
|
|
|
|
||
|
|
|
|
|
|
ST25TV02K/512 in Selected state |
- |
X |
X |
- |
|
|
|
|
|
|
|
ST25TV02K/512 in Ready, Quiet or Selected state (the device |
X |
- |
- |
X |
|
which matches the UID) |
|||||
|
|
|
|
||
|
|
|
|
|
|
Error (03h) or no response (command dependent) |
X |
- |
X |
- |
|
|
|
|
|
|
Figure 9. state transition diagram
Power off
Out of field |
In RF field |
after tRF_OFF |
|
Out of RF field after tRF_OFF
Inventory |
Ready |
|
Any other command |
||||||||
|
where Select_Flag |
||||||||||
|
|
||||||||||
|
|
|
|
|
|
|
|
|
|
is not set |
|
|
|
ready |
|
Reset |
|
Select |
|||||
|
|
|
|
|
|
|
|
|
|
||
|
|
|
quiet(UID) |
Select to |
|
|
|
||||
|
to |
|
|
Select |
_ |
|
|
|
|
(UID) |
|
Reset |
|
Stay |
|
|
|
Flagready |
|
||||
|
|
|
|
(# |
|
|
|
|
|||
|
|
|
|
|
with |
is |
where |
||||
|
|
|
|
|
|
|
|
|
set |
|
|
|
|
|
|
|
|
|
UID) or |
Out of RF field after tRF_OFF
Select (UID)
Quiet
Stay quiet(UID)
Any other command where the
Address_Flag is set AND where the Inventory_Flag is not set
Selected
Any other command
1.The ST25TV02K/512 return to the Power Off state if the tag is out of the field for at least tRF_OFF.
The intention of the state transition method is that only one ST25TV02K/512 should be in the Selected state at a time.
When the Select_flag is set to 1, the request shall NOT contain a unique ID. When the address_flag is set to 0, the request shall NOT contain a unique ID.
The term “mode” refers to the mechanism used in a request to specify the set of ST25TV02K/512 devices that shall execute the request.
Addressed mode
When the Address_flag is set to 1 (Addressed mode), the request contains the Unique ID (UID) of the addressed ST25TV02K/512.
DS12074 - Rev 11 |
page 27/90 |
|
|