STMicroelectronics ST25DV64K Datasheet

. See Section 9.2 I2C DC and AC parameters

Energy Harvesting

Interrupt Output

Serial Data

Serial Clock

Antenna coils

Supply voltage

Ground

Low power down mode

Supply voltage for GPO driver

Not connected

Exposed Pad

Function

1. Available only on 10-ball and 12-pin packages.

2. Available only on UFDPN8 and UFDFPN12 packages.

Direction

Power output

Output

I/O

Input

Power

Input

Power

Must be left floating

Figure 2. ST25DVxxx 8-pin packages connections with open drain Interruption Output

V_EH

AC0

AC1

VSS

EP 1

VCC

GPO (OD)

SCL

SDA

Exposed Pad is only present on UFDFPN8 package.

DS10925 - Rev 9 page 4/200

ST25DV04K ST25DV16K ST25DV64K

ST25DVxxx packaging

Figure 3. ST25DVxxx 12-pin package connections with Cmos interrupt output (GPO)

LPD

V_EH 3

AC0

AC1

VSS

EP 1

VCC

GPO (CMOS)

VDCG

SCL

SDA

Exposed Pad is only present on UFDFPN12 package.

Figure 4. ST25DVxxx 10-ball WLCSP package connections with Cmos interrupt output (GPO)

1 2 3 4 4 3 2 1

VCC

VDCG

SDA

GPO

SCL

V_EH

LPD

VSS

AC0

AC1

Marking side

(top view)

AC0

AC1

V_EH

LPD

VSS

VCC

GPO

SCL

VDCG

SDA

Bump side

(bottom view)

DS10925 - Rev 9 page 5/200

2.2

2.2.1

Note:

2.2.2

2.1

2.1.1

2.1.2

2.2.3

ST25DV04K ST25DV16K ST25DV64K

Signal descriptions

Signal descriptions

Serial link (SCL, SDA)

Serial clock (SCL)

This input signal is used to strobe all data in and out of the ST25DVxxx. In applications where this signal is used by slave devices to synchronize the bus to a slower clock, the bus master must have an open drain output, and a pull-up resistor must be connected from Serial Clock (SCL) to V

to know how to calculate the value of this pull-up resistor

Serial data (SDA)

This bidirectional signal is used to transfer data in or out of the ST25DVxxx. It is an open drain output that may be wire-OR’ed with other open drain or open collector signals on the bus. A pull-up resistor must be connected from Serial Data (SDA) to V

. ( Figure 76. I 2 C Fast mode (f

= 1 MHz): maximum R bus

value versus bus parasitic capacitance (C bus

) indicates how the value of the pull-up resistor can be calculated).

Power control (V

, LPD,V

)

Supply voltage (V

)

This pin can be connected to an external DC supply voltage.

An internal voltage regulator allows the external voltage applied on V

to supply the ST25DVxxx, while preventing the internal power supply (rectified RF waveforms) to output a DC voltage on the V

pin.

Low Power Down (LPD)

This input signal is used to control an internal 1.8 V regulator delivering ST25DVxxx internal supply. When LPD is high, this regulator is shut off and its consumption is reduced below 1µA. This regulator has a turn on time in range of 100us, to be added to the boot duration, before the device becomes fully operational. The impedance on

LDP pin when set high doesn't exceed 5kΩ.

This feature is only available on the 10-ball and 12-pin ST25DVxxx package. The LPD pin is internally pulleddown.

Ground (V

)

is the reference for the V

and V

DCG supply voltages and V_EH analog output voltage.

DS10925 - Rev 9 page 6/200

2.3

2.3.1

2.4

2.4.1

2.4.2

2.5

ST25DV04K ST25DV16K ST25DV64K

RF link (AC0 AC1)

Antenna coil (AC0, AC1)

These inputs are used to connect the ST25DVxxx device to an external coil exclusively. It is advised not to connect any other DC or AC path to AC0 or AC1.

When correctly tuned, the coil is used to power and access the device using the ISO/IEC 15693 and ISO 18000-3 mode 1 protocols.

Process control (V

DCG

, GPO)

Driver Supply voltage (V

DCG

)

This pin, available only with ST25DVxx-JF version, can be connected to an external DC supply voltage. It only supplies the GPO driver block. ST25DVxxx cannot be powered by V

DCG

. If V

DCG

is left floating, no information will be available on GPO pin.

General purpose output (GPO)

The ST25DVxxx features a configurable output GPO pin used to provide RF activity information to an external device. ST25DVxx-IE offers a GPO open drain. This GPO pin must be connected to an external pull-up resistor

(> 4.7 KΩ) to operate.

The interrupt consists in pulling the state to a low level or outputting a low-level pulse on GPO pin.

ST25DVxx-JF offers a GPO CMOS output, which requires to connect V

DCG pin to an external power supply. The interrupt consists in setting the state to a high level or outputting a positive pulse on the GPO pin.

GPO pin is a configurable output signal, and can mix several Interruption modes. By default, the GPO register sets the interruption mode as a RF Field Change detector. It is able to raise various events like RF Activity,

Memory Write completion, or fast transfer actions. It can authorize the RF side to directly drive GPO pin using the

Manage GPO command to set the output state or emit a single pulse (for example, to wake up an application.).

See

Section 5.2 GPO

for details.

Energy harvesting analog output (V_EH)

This analog output pin is used to deliver the analog voltage V_EH available when the Energy harvesting mode is enabled and if the RF field strength is sufficient. When the Energy harvesting mode is disabled or the RF field strength is not sufficient, V_EH pin is in High-Z state (See

Section 5.3 Energy Harvesting (EH)

for details).

Energy harvesting voltage output is not regulated.

DS10925 - Rev 9 page 7/200

ST25DV04K ST25DV16K ST25DV64K

Power management

Power management

3.1

Wired interface

Operating supply voltage V

In contact mode, prior to selecting the memory and issuing instructions to it, a valid and stable V

voltage within the specified [V

(min), V

(max)] range must be applied (see

Table 243. I 2 C operating conditions

). To maintain a stable DC supply voltage, it is recommended to decouple the V

line with a suitable capacitor (usually of the order of 10 nF and 100 nF) close to the V

package pins.

This voltage must remain stable and valid until the end of the transmission of the instruction and, for a Write instruction, until the completion of the internal I²C write cycle (t

). Instructions are not taken into account until completion of ST25DVxxx's boot sequence (see

Figure 5. ST25DVxxx power-up sequence (No RF field, LPD pin tied to V

or package without LPD pin)

Figure 5. ST25DVxxx power-up sequence (No RF field, LPD pin tied to V

or package without LPD pin)

V cc

Power-Up by V cc

(No V cc

; V

DCG

)

Vint_supply

None

Access

Allowed

RF or I 2 C

I

C interface ready

I 2 C Start

RF Access not allowed

I 2 C Stop t boot

I 2 C

* When RF Field is present before V

set up boot is performed after RF field rising .

* If LPD pin follow V

before to goes low , t boot

will start only when LPD reach the low level

Power-up conditions

When the power supply is turned on, V

rises from V

to V

. The V

rise time must not vary faster than

1V/µs.

Device reset in I²C mode

In order to prevent inadvertent write operations during power-up, a power-on reset (POR) circuit is included. At power-up (continuous rise of V

), the ST25DVxxx does not respond to any I²C instruction until V

has reached the power-on reset threshold voltage (this threshold is lower than the minimum V

operating voltage defined in

Table 243. I 2 C operating conditions ). When V

passes over the POR threshold, the device is reset and enters the Standby power mode. However, the device must not be accessed until V

voltage within the specified [V

CC(min)

, V

CC(max)

has reached a valid and stable

] range and t_boot time necessary to ST25DVxxx set-up has passed. In the version supporting LPD pin, the boot will take place only when LPD goes low.

In a similar way, during power-down (continuous decrease in V

), as soon as V

drops below the power-on reset threshold voltage, the device stops responding to any instruction sent to it, and I 2 C address counter is reset.

DS10925 - Rev 9 page 8/200

ST25DV04K ST25DV16K ST25DV64K

Contactless interface

3.2

Power-down mode

During power-down (continuous decay of V

), the device must be in Standby power mode (mode reached after decoding a Stop condition, assuming that there is no internal write cycle in progress).

Contactless interface

Device set in RF mode

To ensure a proper boot of the RF circuitry, the RF field must be turned ON without any modulation for a minimum period of time t

RF_ON

. Before this time, ST25DVxxx will ignore all received RF commands. (See

Figure 6. ST25DVxxx RF power-up sequence (No DC supply)

Device reset in RF mode

To ensure a proper reset of the RF circuitry, the RF field must be turned off (100% modulation) for a minimum t

RF_OFF

period of time.

The RF access can be temporarily or indefinitely disabled by setting the appropriate value in the RF disable register.

Figure 6. ST25DVxxx RF power-up sequence (No DC supply)

RF interface ready

RFfield

None Access

Allowed

RF or I2C t boot

Power-Up by RF

(No Vcc ; V

DCG

)

GPO CMOS Version

Vint_supply

GPO = RF_ACTIVITY tminCD

RF REQUEST

REQ

EOF

GPO = FIELD CHANGE

IT duration

GPO = FIELD CHANGE AND RF_ACTIVITY

No answer to RF

Request if any

RF ANSWER

ANS

EOF

DS10925 - Rev 9 page 9/200

4.1

ST25DV04K ST25DV16K ST25DV64K

Memory management

Memory management

Memory organization overview

•

The ST25DVxxx memory is divided in four main memory areas:

• User memory

•

Dynamic registers

Fast transfer mode buffer

System configuration area

The ST25DVxxx user memory can be divided into 4 flexible user areas. Each area can be individually read and/or - write-protected with one out of three specific 64-bit password.

The ST25DVxxx dynamic registers are accessible by RF or I 2 C host and provide dynamic activity status or allow temporary activation or deactivation of some ST25DVxxx features.

The ST25DVxxx also provides a 256 byte fast transfer mode buffer, acting as a mailbox between RF and I 2 C interface, allowing fast data transfer between contact and contactless worlds.

Finally, the ST25DVxxx system configuration area contains static registers to configure all ST25DVxxx features, which can be tuned by user. Its access is protected by a 64 bit configuration password.

This system configuration area also includes read only device information such as IC reference, memory size or

IC revision, as well as a 64-bit block that is used to store the 64-bit unique identifier (UID), and the AFI (default

00h) and DSFID (default 00h) registers. The UID is compliant with the ISO 15693 description, and its value is used during the anticollision sequence (Inventory). The UID value is written by ST on the production line. The AFI register stores the application family identifier. The DSFID register stores the data storage family identifier used in the anticollision algorithm.

The system configuration area includes five additional 64-bit blocks that store an I 2 C password plus three RF user area access passwords and a RF configuration password.

DS10925 - Rev 9 page 10/200

ST25DV04K ST25DV16K ST25DV64K

User memory

Figure 7. Memory organization

User memory

(EEPROM up to 64-Kbits)

Password protected

Dynamic configuration and activity status

Fast Transfer Mode mailbox

CC File

Area 1

Always readable

Area 2

Area 3

Area 4

Dynamic registers

Fast Transfer Mode

256 Bytes buffer

System configuration

(EEPROM)

Password protected

Static configuration registers

Device information

UID, AFI, DSFID

Passwords

4.2

User memory

User memory is accessible from both RF contactless interface and I 2 C wired interface.

From RF interface, user memory is addressed as Blocks of 4 bytes, starting at address 0. RF extended read and write commands can be used to address all ST25DVxxx memory blocks. Other read and write commands can only address up to block FFh.

From I 2 C interface, user memory is addressed as Bytes, starting at address 0. Device select must be set with

E2=0.

User memory can be read in continuity. Unlike the RF interface, there is no roll-over when the requested address reaches the end of the memory capacity.

Table 2

shows how memory is seen from RF interface and from I 2 C interface.

DS10925 - Rev 9 page 11/200

ST25DV04K ST25DV16K ST25DV64K

User memory

Table 2. User memory as seen by RF and by I 2 C

RF command

(block addressing)

User memory

Read Single Block

Read Multiple Blocks

Fast Read Single Block

Fast Read Multiple Blocks

Write Single Block

Write Multiple Blocks

Ext Read Single Block

Ext Read Multiple Blocks

Fast Ext Read Single Block

Fast Ext Read Multi. Blocks

Ext Write Single Block

Ext Write Multiple Blocks

C byte

0003h

C byte

0007h

C byte

000Bh

C byte

01FFh

C byte

03FFh

RF block (00)00h

I 2 C byte

0002h

I 2 C byte

0001h

RF block (00)01h

I 2 C byte

0006h

I 2 C byte

000Ah

I 2 C byte

0005h

RF block (00)02h

I 2 C byte

0009h

....

RF block (00)7Fh (1)

I 2 C byte

01FEh

I 2 C byte

01FDh

....

RF block (00)FFh (2)

I 2 C byte

03FEh

I 2 C byte

03FDh

RF block 0100h

C byte

0000h

C byte

0004h

C byte

0008h

C byte

01FCh

2 C byte

03FCh

I 2 C byte

0403h

I 2 C byte

0402h

I 2 C byte

0401h

I 2 C byte

0400h

Ext Read Single Block

Ext Read Multiple Blocks

Fast Ext Read Single Block

Fast Ext Read Multi. Blocks

Ext Write Single Block

Ext Write Multiple Blocks

I 2 C byte

07FFh

I 2 C byte

07FEh

....

RF block 01FFh

....

I 2

Table 11. System configuration memory map for ENDA1 register.

C byte

07FDh

I 2 C byte

07FCh

RF block 07FFh (4)

I 2 C byte

1FFFh

I 2 C byte

1FFEh

I 2 C byte

1FFDh

I 2 C byte

1FFCh

1. Last block of user memory in ST25DV04K ‑ XX..

2. Last block accessible with Read Single Block, Read Multiple Blocks, Fast Read Single Block, Fast Read

Multiple Blocks, Write Single Block and Write Multiple Blocks RF commands.

3. Last block of user memory in ST25DV16K ‑ XX.

4. Last block of user memory in ST25DV64K ‑ XX.

Note: In the factory all blocks of user memory are initialized to 00h.

I 2 C command

(byte addressing)

I 2 C Read command

I 2 C Write command

Device select E2=0

DS10925 - Rev 9 page 12/200

4.2.1

ST25DV04K ST25DV16K ST25DV64K

User memory

User memory areas

The user memory can be split into different areas, each one with a distinct access privilege.

RF and I 2 C read and write commands are legal only within a same zone:

• In RF, a multiple read or a multiple write command is not executed and returns the error code 0Fh if addresses cross the area borders.

• In I 2 C, a read data always return FFh after crossing an area border. A write command is not acknowledged and not executed if the command crosses the area border.

Each user memory area is defined by its ending block address ENDA i the end of the preceding area.

. The starting block address is defined by

There are three ENDA i

registers in the configuration system memory, used to define the end block addresses of

Area 1, Area 2 and Area 3. The end of Area 4 is always the last block of memory and is not configurable.

Figure 8. ST25DVxxx user memory areas

Areas limit registers

ENDA1

ENDA2

ENDA3

ST25DV user memory

Area1

(8 Blocks/32 Bytes minimum)

Area2

Area3

Area4

Block/Byte 0000h

Last Block/Byte of user memory

On factory delivery all ENDA i

are set to maximum value, only Area1 exists and includes the full user memory.

A granularity of 8 Blocks (32 Bytes) is offered to code area ending points.

An area’s end limit is coded as followed in ENDA i

registers:

• Last RF block address of area = 8 x ENDA i

+ 7 => ENDA i

= int(Last Area i

RF block address / 8)

•

Last I 2 C byte address of area = 32 * ENDA i

+ 31 => ENDA i

= int(Last Area i

I 2 C byte address / 32)

As a consequence, ENDA1 = 0 minimum size of Area 1 is 8 blocks (32 Bytes).

Device

ST25DV04K-xx

ST25DV16K-xx

ST25DV64K-xx

Table 3. Maximum user memory Block and Byte addresses and ENDA i

value

Last user memory block address seen by RF

007Fh

01FFh

07FFh

Last user memory byte address seen by I 2 C

01FFh

07FFh

1FFFh

Maximum ENDA i

value

0Fh

3Fh

FFh

DS10925 - Rev 9 page 13/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

User memory

Area

Area 1

Area 2

Area 3

Area 4

Table 4. Areas and limit calculation from ENDA i

registers

Seen from RF interface

Block 0000h

…

Block (ENDA1*8)+7

Block (ENDA1+1)*8

…

Block (ENDA2*8)+7

Block (ENDA2+1)*8

…

Block (ENDA3*8)+7

Block (ENDA3+1)*8

…

Last memory Block

Seen from I 2 C interface

Byte 0000h

…

Byte (ENDA1*32)+31

Byte (ENDA1+1)*32

…

Byte (ENDA2*32)+31

Byte (ENDA2+1)*32

…

Byte (ENDA3*32)+31

Byte (ENDA3+1)*32

…

Last memory Byte

•

Organization of user memory in areas have the following characteristics:

• At least one area exists (Area1), starting at Block/Byte address 0000h and finishing at ENDA1, with ENDA1

= ENDA2 = ENDA3 = End of user memory (factory setting).

•

Two Areas could be defined by setting ENDA1 < ENDA2 = ENDA3 = End of user memory.

Three Areas may be defined by setting ENDA1 < ENDA2 < ENDA3 = End of user memory.

A maximum of four areas may be defined by setting ENDA1 < ENDA2 < ENDA3 < End of user memory.

• Area 1 specificities

– Start of Area1 is always Block/Byte address 0000h.

– Area1 minimum size is 8 Blocks (32 Bytes) when ENDA1 = 00h.

– Area1 is always readable.

The last area always finishes on the last user memory Block/Byte address (ENDA4 doesn't exist).

All areas are contiguous: end of Area(n) + one Block/Byte address is always start of Area(n+1).

Area size programming

RF user must first open the RF configuration security session to write ENDAi registers.

I 2 C host must first open I 2 C security session to write ENDAi registers.

When programming an ENDAi register, the following rule must be respected:

• ENDAi-1 < ENDAi ≤ ENDAi+1 = End of memory.

•

This means that prior to programming any ENDAi register, its successor (ENDAi+1) must first be programmed to the last Block/Byte of memory:

•

Successful ENDA3 programming condition: ENDA2 < ENDA3 ≤ End of user memory

Successful ENDA2 programming condition: ENDA1 < ENDA2 ≤ ENDA3 = End of user memory

Successful ENDA1 programming condition: ENDA1 ≤ ENDA2 = ENDA 3 = End of user memory

If this rule is not respected, an error 0Fh is returned in RF, NoAck is returned in I2C, and programming is not done.

In order to respect this rule, the following procedure is recommended when programming Areas size (even for changing only one Area size): page 14/200

ST25DV04K ST25DV16K ST25DV64K

User memory

Ends of Areas 3 and 2 must first be set to the end of memory while respecting the following order: a.

If ENDA3 ≠ end of user memory, then set ENDA3 = end of memory; else, do not write ENDA3.

If ENDA2 ≠ end of user memory, then set ENDA2 = end of memory; else, do not write ENDA2.

Then, desired area limits can be set respecting the following order: a.

Set new ENDA1 value.

Set new ENDA2 value, with ENDA2 > ENDA1 c.

Set new ENDA3 value, with ENDA3 > ENDA2

Example of successive user memory area setting (for a ST25DV64K-xx):

Initial state, 2 Areas are defined: a.

ENDA1 = 10h (Last block of Area 1: (10h x 8) + 7 = 0087h) b.

ENDA2 = FFh (Last block of Area 2: (FFh x 8) + 7 = 07FFh) c.

ENDA3 = FFh (No Area 3)

◦

Area 1 from Block 0000h to 0087h (136 Blocks)

Area 2 from Block 0088h to 07FFh (1912 Blocks)

There is no Area 3

There is no Area 4

Split of user memory in four areas: a.

ENDA3 is not updated as it is already set to end of memory b.

ENDA2 is not updated as it is already set to end of memory c.

Set ENDA1 = 3Fh (Last block of Area 1: (3Fh x 8) + 7 = 01FFh) d.

Set ENDA2 = 5Fh (Last block of Area 1: (5Fh x 8) + 7 = 02FFh) e.

Set ENDA3 = BFh (Last block of Area 1: (BFh x 8) + 7 = 05FFh)

◦

Area1 from Block 0000h to 01FFh (512 Blocks)

Area2 from Block 0200h to 02FFh (256 Blocks)

◦

Area3 from Block 0300h to 05FFh (768 Blocks)

Area4 from Block 0600h to 07FFh (512 Blocks).

Return to a split in two equal areas: a.

Set ENDA3 = FFh b.

Set ENDA2 = FFh c.

Set ENDA1 = 7Fh (Last block of Area 1: (7Fh x 8) + 7 = 03FFh)

◦

Area1 from Block 0000h to 03FFh (1024 Blocks)

Area2 from Block 0400h to 07FFh (1024 Blocks)

There is no Area3

There is no Area 4

Programming ENDA3 to FFh in step 2.a would have resulted in into an error, since rule ENDAi-1 < ENDAi would not been respected (ENDA2 = ENDA3 in that case).

Registers for user memory area configuration

Table 5. ENDA1 access

Command

Read Configuration (cmd code A0h) @05h

Write Configuration (cmd code A1h) @05h

Type

R always, W if RF configuration security session is open and configuration not locked

I2C

Address Type

E2 = 1, 0005h

R always, W if I2C security session is open

DS10925 - Rev 9 page 15/200

ST25DV04K ST25DV16K ST25DV64K

User memory

Bit b7-b0

Name

ENDA1

Table 6. ENDA1

Function

End Area 1 = 8*ENDA1+7 when expressed in blocks (RF)

End Area 1 = 32*ENDA1+31 when expressed in bytes (I 2 C)

Factory Value

ST25DV04K-xx: 0Fh

ST25DV16K-xx: 3Fh

ST25DV64K-xx: FFh

Note: Refer to

Table 7. ENDA2 access

Command

Read Configuration (cmd code A0h) @07h

Write Configuration (cmd code A1h) @07h

Type

R always, W if RF configuration security session is open and configuration not locked

I2C

Address Type

E2 = 1, 0007h

R always, W if I2C security session is open

Bit b7-b0

Name

ENDA2

Table 8. ENDA2

Function

End Area 2 = 8 x ENDA2 + 7 when expressed in blocks (RF)

End Area 2 = 32*ENDA2 + 31 when expressed in bytes (I 2 C)

Factory Value

ST25DV04K-xx: 0Fh

ST25DV16K-xx: 3Fh

ST25DV64K-xx: FFh

Note: Refer to

Table 11. System configuration memory map for ENDA2 register.

Table 9. ENDA3 access

Command

Read Configuration (cmd code A0h) @09h

Write Configuration (cmd code A1h) @09h

Type

R always, W if RF configuration security session is open and configuration not locked

I2C

Address Type

E2 = 1, 0009h

R always, W if I2C security session is open

Bit b7-b0

Note:

Name

ENDA3

Table 10. ENDA3

Function

End Area 3 = 8 x ENDA3 + 7 when expressed in blocks (RF)

End Area 3 = 32 x ENDA3 + 31 when expressed in bytes (I 2 C)

Refer to

Table 11. System configuration memory map for ENDA3 register.

Factory Value

ST25DV04K-xx: 0Fh

ST25DV16K-xx: 3Fh

ST25DV64K-xx: FFh

DS10925 - Rev 9 page 16/200

ST25DV04K ST25DV16K ST25DV64K

System configuration area

4.3

System configuration area

In addition to EEPROM user memory, ST25DVxxx includes a set of static registers located in the system configuration area memory (EEPROM nonvolatile registers). Those registers are set during device configuration

(i.e.: area extension), or by the application (i.e.: area protection). Static registers content is read during the boot sequence and define basic ST25DVxxx behavior.

In RF, the static registers located in the system configuration area can be accessed via dedicated Read

Configuration and Write Configuration commands, with a pointer acting as the register address.

The RF configuration security session must first be open, by presenting a valid RF configuration password, to grant write access to system configuration registers.

The system configuration area write access by RF can also be deactivated by I 2 C host.

In I 2 C static registers located in the system configuration area can be accessed with I 2 C read and write commands with device select E2=1. Readable system areas could be read in continuity.

I 2 C security session must first be open, by presenting a valid I 2 C password, to grant write access to system configuration registers.

Table 11. System configuration memory map shows the complete map of the system configuration area, as seen

by RF and I 2 C interface.

Table 11. System configuration memory map

RF access

Address

00h

01h

Type

Name

Static Register

Function

Enable/disable ITs on GPO

Interruption pulse duration

EH_MODE

Energy Harvesting default strategy after Power ON 02h

03h

04h

RW (1)

RF_MNGT

RF interface state after Power ON

RFA1SS

Area1 RF access protection

05h

06h

07h

08h

Area 1 ending point

Area2 RF access protection

Area 2 ending point

Area3 RF access protection

09h

0Ah

RW (1)

No access

N/A

0Dh

0Eh

Area 3 ending point

Area4 RF access protection

Area 1 to 4 I 2 C access protection

RW (3) (4)

LOCK_CCFILE

Blocks 0 and 1 RF Write protection

RW (1)

MB_MODE

Fast transfer mode state after power ON

Maximum time before the message is automatically released

0Fh

N/A

Protect RF Write to system configuration registers

DSFID lock status

AFI lock status

DSFID value

AFI value

Memory size value in blocks, 2 bytes

Block size value in bytes

IC reference value

E2=1

Device select

I 2 C access

Address

E2=1

0000h

0001h

E2=1

0002h

0003h

0004h

0005h

0006h

0007h

0008h

0009h

000Ah

000Bh

000Ch

000Dh

000Eh

000Fh

0010h

0011h

0012h

0013h

0014h to 0015h

0016h

0017h

Type

Section 5.6.3 User memory protection )

DS10925 - Rev 9 page 17/200

ST25DV04K ST25DV16K ST25DV64K

System configuration area

RF access

Address

No access

N/A

Type

WO (9)

(9)

Name

Static Register

Function

UID

IC_REV

Unique identifier, 8 bytes

IC revision

ST Reserved

I2C_PWD

I 2 C security session password, 8 bytes

RF_PWD_0

RF configuration security session password, 8 bytes

RF_PWD_1

RF_PWD_2

RF_PWD_3

RF user security session password 1, 8 bytes

RF user security session password 2, 8 bytes

RF user security session password 3, 8 bytes

1. Write access is granted if RF configuration security session is open and configuration is not locked

(LOCK_CFG register equals to 0).

2. Write access if I 2 C security session is open.

3. Write access to bit 0 if Block 00h is not already locked and to bit 1 if Block 01h is not already locked.

4. LOCK_CCFILE content is only readable through reading the Block Security Status of blocks 00h and 001h

(see

5. Write access if DSFID is not locked

6. Write access if AFI is not locked.

7. Write access with I 2 C Write Password command, only after presenting a correct I 2 C password.

8. Read access is granted if I 2 C security session is open.

9. Write access only if corresponding RF security session is open.

Device select

I 2 C access

Address

E2=1

0018h to 001Fh

0020h

0021h

0022h

0023h

Type

0900h to 0907h R/W

(7) (8)

No access

DS10925 - Rev 9 page 18/200

ST25DV04K ST25DV16K ST25DV64K

Dynamic configuration

4.4

Dynamic configuration

ST25DV has a set of dynamic registers that allow temporary modification of its behavior or report on its activity.

Dynamic registers are volatile and not restored to their previous values after POR.

Some static registers have an image in dynamic registers: dynamic register value is initialized with the static register value and may be updated by the application to modify the device behavior temporarily (i.e.: set reset of Energy Harvesting). When a valid change occurs in a static register, in RF or I 2 C, the corresponding dynamic register is automatically updated.

Other, dynamic registers, automatically updated, contain indication on ST25DV activity. (i.e.: IT_STS_Dyn gives the interruption’s status or MB_CTRL_Dyn gives the fast transfer mode mailbox control).

In RF, dynamic registers can be accessed via dedicated (Fast) Read Dynamic Configuration and (Fast) Write

Dynamic Configuration commands, with a pointer acting as the register address. No password is needed to access dynamic registers.

In I 2 C, dynamic registers can be accessed with I 2 C read and write commands with device select E2=0. Dynamic registers can be read in continuity. Dynamic registers and fast transfer mode mailbox can be read in continuity, but not written in continuity. No password is needed to access dynamic registers.

Table 12. Dynamic registers memory map shows the complete map of dynamic registers, as seen by RF interface

and by I 2 C interface.

RF access

Address Type

00h

No access

02h R/W

No access

0Dh

R/W

Table 12. Dynamic registers memory map

Dynamic Registers

Name

Function

GPO control

ST Reserved

Energy Harvesting management & usage status

RF interface usage management

I 2 C security session status

Interruptions Status

Fast transfer mode control and status length of fast transfer mode message

Device select

E2 = 0

I 2 C access

Address

2000h

2001h

2002h

2003h

2004h

2005h

2006h

2007h

Type

R/W

DS10925 - Rev 9 page 19/200

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode mailbox

4.5

RF access

Address Type

00h

01h

…

FEh

FFh

R/W

…

R/W

Fast transfer mode mailbox

ST25DVxxx fast transfer mode uses a dedicated mailbox buffer for transferring messages between RF and I 2 C worlds. This mailbox contains up to 256 Bytes of data which are filled from the first byte.

Fast transfer mode mailbox is accessed in bytes from both RF and I 2 C.

In RF, mailbox is read via a dedicated (Fast) Read Message command. Read can start from any address value inside the mailbox, between 00h and FFh. Writing in the mailbox is done via the (Fast) Write Message command in one shot, always starting at mailbox address 00h. No password is needed to access mailbox from RF, but fast transfer mode must be enabled.

In I 2 C, mailbox read can start from any address value between 2008h and 2107h. Write mailbox MUST start from address 2008h to a max of 2107h. No password is needed to access mailbox from I 2 C, but fast transfer mode must be enabled.

Table 13. Fast transfer mode mailbox memory map

shows the map of fast transfer mode mailbox, as seen by RF interface and by I 2 C interface.

Table 13. Fast transfer mode mailbox memory map

Fast transfer mode buffer

Function Name

MB_Dyn Byte 0

MB_Dyn Byte 1

…

MB_Dyn Byte 254

MB_Dyn Byte 255

Fast transfer mode buffer (256-Bytes)

Device select

E2 = 0

I 2 C access

Address

2008h

2009h

...

2106h

2107h

Type

R/W

...

R/W

DS10925 - Rev 9 page 20/200

ST25DV04K ST25DV16K ST25DV64K

ST25DVxxx specific features

ST25DVxxx specific features

ST25DVxxx offers the following features:

•

A fast transfer mode (FTM), to achieve a fast link between RF and contact worlds, via a 256 byte buffer called Mailbox. This mailbox dynamic buffer of 256 byte can be filled or emptied via either RF or I 2 C.

A GPO pin, which indicates incoming event to the contact side, like RF Field changes, RF activity in progress, RF writing completion or Mailbox message availability.

An Energy Harvesting element to deliver µW of power when external conditions make it possible.

• RF management, which allows ST25DVxxx to ignore RF requests.

•

All these features can be programmed by setting static and/or dynamic registers of the ST25DVxxx. ST25DVxxx can be partially customized using configuration registers located in the E 2 system area.

These registers are:

•

• dedicated to Data Memory organization and protection ENDA dedicated to fast transfer mode MB_WDG, MB_MODE i

, I2CSS, RFAiSS, LOCK_CCFILE.

dedicated to observation, GPO, IT_TIME dedicated to RF , RF_MNGT, EH_MODE dedicated the device’s structure LOCK_CFG

A set of additional registers allows to identify and customize the product (DSFID, AFI, IC_REF, etc.).

In I²C,

Read accesses to the static configuration register is always allowed, except for passwords. For dedicated registers, write access is granted after prior successful presentation of the I 2 C password. Configuration register are located from @00h to 0Fh in the system area (device code 111)

In RF

Dedicated commands Read Configuration and Write Configuration must be used to access the static configuration registers. Update is only possible when the access right was granted by presenting the RF configuration password (RF_PWD_0), and if the system configuration was not previously locked by the I 2 C host

(LOCK_CFG=1), which acts as security master.

•

After any valid write access to the static configuration registers, the new configuration is immediately applied.

Some of the static registers have a dynamic image (notice _Dyn) preset with the static register value:

GPO_CTRL_Dyn, EH_CTRL_Dyn, RF_MNGT_Dyn and MB_CTRL_Dyn.

When it exists, ST25DVxxx uses the dynamic configuration register to manage its processes. A dynamic configuration register updated by the application will recover its default static value after a Power On Reset

(POR).

Other dynamic registers are dedicated to process monitoring:

• I2C_SSO_Dyn is dedicated to data memory protection

MB_LEN_Dyn, MB_CTRL_Dyn are dedicated to fast transfer mode

IT_STS_Dyn is dedicated to interrupt

In I

C, read and write of the Dynamic registers is done using usual I

C read & write command at dedicated address. (E2 =0 in device select).

In RF read or write accesses to the Dynamic registers are associated to the dedicated commands, Read Dynamic

Configuration, Write Dynamic Configuration and Read Message Length.

DS10925 - Rev 9 page 21/200

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode (FTM)

5.1

5.1.1

Fast transfer mode (FTM)

Fast transfer mode registers

Static Registers

Table 14. MB_MODE access

Command

Read Configuration (cmd code A0h) @0Dh

Write Configuration (cmd code A1h) @0Dh

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2=1, 000Dh

I2C

Type

R always, W if I2C security session is open

Bit b0 b7-b1

Note:

Name

MB_MODE

RFU

Table 15. MB_MODE

Function

0: Enabling fast transfer mode is forbidden.

1: Enabling fast transfer mode is authorized.

Refer to

Table 11. System configuration memory map for the MB_MODE register.

Table 16. MB_WDG access

Command

Read Configuration (cmd code A0h) @0Eh

Write Configuration (cmd code A1h) @0Eh

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2=1, 000Eh

Factory Value

0000000b

I2C

Type

R always, W if I 2 session is open

C security

Bit b2-b0 b7-b3

Note:

Name

MB_WDG

RFU

Table 17. MB_WDG

Function

Watch dog duration = 2 (MB_WDG-1) x30ms±6

If MD_WDG = 0, then watchdog duration is infinite

Refer to

Table 11. System configuration memory map for the MB_WDG register.

Factory Value

111b

00000b

DS10925 - Rev 9 page 22/200

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode (FTM)

Dynamic Registers

Table 18. MB_CTRL_Dyn access

Command

Read Dynamic Configuration (cmd code ADh) @0Dh

Fast Read Dynamic Configuration (cmd code CDh) @0Dh

Write Dynamic Configuration (cmd code AEh) @0Dh

Fast Write Dynamic Configuration (cmd code CEh) @0Dh

Type b0: R always, W always b7-b1: RO

Address

E2 = 0, 2006h

I2C

Type b0: R always, W always b7-b1: RO

Table 19. MB_CTRL_Dyn

Bit b0 b1 b2 b3 b4 b5 b6 b7

Name

MB_EN (1)

HOST_PUT_MSG

RF_PUT_MSG

RFU

HOST_MISS_MSG

RF_MISS_MSG

HOST_CURRENT_MSG

RF_CURRENT_MSG

Function

0: Disable FTM, FTM mailbox is empty

1: Enable FTM

0: No I 2 C message in FTM mailbox

1: I 2 C has Put a message in FTM mailbox

0: No RF message in FTM mailbox

1: RF has Put message in FTM mailbox

0: No message missed by I 2 C

1: I 2 C did not read RF message before watchdog time out

0: No message missed by RF

1: RF did not read message before watchdog time out

0: No message or message not coming from I 2 C

1: Current Message in FTM mailbox comes from I 2 C

0: No message or message not coming from RF

1: Current Message in FTM mailbox comes from RF

1. MB_EN bit is automatically reset to 0 if MB_MODE register is reset to 0.

Note: Refer to

Table 12. Dynamic registers memory map for the MB_CTRL_Dyn register.

Command

Read Message Length (cmd code ABh)

Fast Read Message Length (cmd code CBh)

Table 20. MB_LEN_Dyn access

Type Address

E2 = 0, 2007h

I2C

Type

Factory Value

DS10925 - Rev 9 page 23/200

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode (FTM)

Note:

5.1.2

Bit b7-b0

Name

MB_LEN

Table 21. MB_LEN_Dyn

Function

Size in byte, minus 1 byte, of message contained in FTM mailbox (automatically set by ST25DVxxx)

Factory Value

Refer to

Table 12. Dynamic registers memory map for the MB_LEN_Dyn register.

Fast transfer mode usage

ST25DV acts as mailbox between RF (reader, smartphone, ...) and an I 2 C host (microcontroller...). Each interface can send a message containing up to 256 bytes of data to the other interface through that mailbox.

To send data from RF reader to I 2 C host, fast transfer mode must be enabled, the mailbox must be free, V

CC power must be present, and the RF user must first writes the message containing data in the mailbox.

C host is then informed (by interruption on GPO output or polling on MB_CTRL_Dyn register) that a message from RF is present in the mailbox.

Once the complete message has been read by I 2 C, mailbox is considered free again and is available for receiving a new message (data is not cleared).

The RF user is informed that the message has been read by the I 2 C host by polling on MB_CTRL_Dyn register.

Figure 9. RF to I 2 C fast transfer mode operation

I2C host I2C

1Mb/s

ST25DV

Dynamic registers

MB_LEN_Dyn

MB_CRTL_Dyn

RF message

Fast Transfer Mode mailbox

(256 Bytes)

26.5kb/s

ISO/IEC

15693 reader

GPO/RF_PUT_MSG

Static registers

MB_MODE

MB_WDG

To send data from the I 2 C host to the RF reader, fast transfer mode must be enabled, the mailbox must be free,

power must be present, and the I2C host must first write the message containing data in the mailbox.

The RF user must poll on MB_CTRL_Dyn register to check for the presence of a message from I 2 C in the mailbox.

Once the complete message has been read by RF user, mailbox is considered free again and is available for receiving a new message (data is not cleared).

The I 2 C host is informed that message has been read by RF user through a GPO interruption or by polling on the

MB_CTRL_Dyn register.

DS10925 - Rev 9 page 24/200

I2C host I2C

1Mb/s

GPO/RF_GET_MSG

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode (FTM)

Figure 10. I 2 C to RF fast transfer mode operation

ST25DV

Dynamic registers

MB_LEN_Dyn

MB_CRTL_Dyn

Fast Transfer Mode mailbox

(256 Bytes)

Host message

Static registers

MB_MODE

MB_WDG

Up to

53kb/s

ISO/IEC

15693 reader

Caution:

supply source is mandatory to activate this feature.

No precedence rule is applied: the first request is served first.

Adding a message is only possible when fast transfer mode is enabled (MB_EN=1) and mailbox is free

(HOST_PUT_MSG and RF_PUT_MSG cleared, which is the case after POR or after complete reading of I 2 C message by RF, and complete reading of RF message by I 2 C).

A watchdog limits the message availability in time: when a time-out occurs, the mailbox is considered free, and the HOST_MISS_MSG or RF_MISS_MSG bits is set into MB_CTRL_Dyn register. The data contained in the mailbox is not cleared after a read or after the watchdog has been triggered: message data is still available for read and until fast transfer mode is disabled. HOST_CURRENT_MSG and RF_CURRENT_MSG bits are indicating the source of the current data.

The message is stored in a buffer (256 Bytes), and the write operation is done immediately. .

The data written in user or system memory (EEPROM), either from I 2 C or from RF, transits via the 256-Bytes fast transfer mode's buffer. Consequently fast transfer mode must be deactivated (MB_EN=0) before starting any write operation in user or system memory, otherwise command will be NotACK for I

C or get an answer 0Fh for RF and programming is not done.

I 2 C access to mailbox

The access by I 2 C can be done by dedicated address mapping to mailbox (2008h to 2107h) with device identifier

E2 = 0.

I 2 C reading operation does not support rollover. Therefore data out is set to FFh when the counter reaches the message end.

The RF_PUT_MSG is cleared after reaching the STOP consecutive to reading the last message byte, and the mailbox is considered free (but the message is not cleared and it is still present in the mailbox).

A I 2 C reading operation will never clear HOST_PUT_MSG, and the message remains available for RF.

An I

C read can start at any address inside the mailbox (between address 2008h and 2107h).

A I 2 C write operation must start from the first mailbox location, at address 2008h. After reaching the Mailbox border at address 2107h all bytes are NACK and the command is not executed (rollover feature not supported).

At the end of a successful I 2 C message write, the message length is automatically set into MB_LEN_Dyn register, and HOST_PUT_MSG bit is set into MB_CTRL_Dyn register, and the write access to the mailbox is not possible until the mailbox has been released again. MB_LEN_Dyn contains the size of the message in byte, minus 1.

DS10925 - Rev 9 page 25/200

ST25DV04K ST25DV16K ST25DV64K

Fast transfer mode (FTM)

RF access to mailbox

•

The RF Control & Access to mailbox is possible using dedicated custom commands:

• Read Dynamic Configuration and Fast Read Dynamic Configuration to check availability of mailbox.

Write Dynamic Configuration and Fast Write Dynamic configuration to enable or disable fast transfer mode.

Read Message Length and Fast Read Message Length to get the length of the contained message,

Read Message and Fast Read Message to download the content of the mailbox,

Write Message and Fast Write Message to put a new message in mailbox. (New length is automatically updated after completion of a successful Write Message or Fast Write Message command).

HOST_PUT_MSG is cleared following a valid reading of the last message byte, and mailbox is considered free

(but message is not cleared and is still present in the mailbox).

A RF read can start at any address of inside the message, but return an error 0Fh if trying to read after the last byte of the message.

A RF reading operation will never clear RF_PUT_MSG , the message will remain available for I 2 C.

At the end of a successful RF message write, the message length is automatically set in MB_LEN_Dyn register, and RF_PUT_MSG bit is set in MB_CTRL_Dyn register. and write access to the mailbox is not possible until mailbox has been freed again.

The presence of a DC supply is mandatory to get RF access to the mailbox. VCC_ON can be checked reading the dynamic register EH_CTRL_Dyn.

To get more details about sequences to prepare and initiate a Fast Transfer, to detect progress of a fast transfer or to control and execute a fast transfer, please refer to AN4910. How to exchange data between wired (I 2 C) and wireless world (RF ISO15693) using fast transfer mode supported by ST25DVxxx).

DS10925 - Rev 9 page 26/200

ST25DV04K ST25DV16K ST25DV64K

GPO

Figure 11. Fast transfer mode mailbox access management.

I2C read msg

MB_EN=00h or

VCC OFF FTM disabled

MB_CTRL_Dyn=00h

No access

MB_EN=00h or

VCC OFF

VCC ON and

MB_EN=01h

MB_EN=00h or

VCC OFF

RF read msg

FTM enabled

I2C Message

MB_CTRL_Dyn=43h

Read access

I2C write msg

RF read full msg

FTM enabled

Mailbox empty

MB_CTRL_Dyn=01h

R/W access

Mailbox free

FTM enabled

Mailbox free

MB_CTRL_Dyn=41/81h

R/W access

RF write msg FTM enabled

RF Message

MB_CTRL_Dyn=85h

Read access

I2C read full

Watchdog trig

RF read

MB_CTRL_Dyn

I2C read

MB_CTRL_Dyn

FTM enabled

Mailbox free

MB_CTRL_Dyn=61/91h

R/W access

Watchdog trig

msg

Note:

5.2

5.2.1

Assuming MB_MODE=01h

Assuming no error occurred

GPO

GPO signal is used to alert the I 2 C host of external RF events or ST25DVxxx processes activity. Several causes could be used to request a host interruption. RF user can also directly drive GPO pin level using a dedicated RF command.

ST25DVxxx interrupt capabilities on RF events

ST25DVxxx supports multi interruption mode and can report several events occurring through RF interface.

In this chapter, all drawings are referring to the open drain version of GPO output (ST25DVxxK-IE).

The reader can retrieve the behaviour of CMOS version (ST25DVxxK-JF) by inverting the GPO curve polarity and replace in text “released” or “high-Z” by “pull to ground”.

Supported RF events is listed hereafter:

DS10925 - Rev 9 page 27/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_USER:

•

GPO output level is controlled by Manage GPO command (set or reset)

When RF_USER is activated, GPO level is changed after EOF of ST25DV response to a Manage GPO set

or reset command (see Section 7.6.30 Manage GPO

RF_USER is prevalent over all other GPO events when set by Manage GPO command (other interrupts are still visible in IT_STS_Dyn status register, but do not change GPO output level).

Figure 12. RF_USER chronogram

1) VCD sends a ManageGPO command with value 00h (set GPO) and ST25DV replies.

GPO/RF_USER is tied low after ST25DV response.

ManageGPO

00h command

F t1 S

ST25DV reply

GPO/RF_USER (OD)

2) VCD sends a ManageGPO command with value 01h (reset GPO) and ST25DV replies.

GPO/RF_USER is set high-Z low after ST25DV response.

ManageGPO

01h command

F t1 S

ST25DV reply

GPO/RF_USER (OD)

3) VCD sends a ManageGPO command (any value) and ST25DV replies with error.

GPO/RF_USER remains high-Z.

ManageGPO command

F t1 S

ST25DV reply

GPO/RF_USER (OD)

4) VCD sends a ManageGPO command (any value) and ST25DV stays quiet (command not for this

VICC, or quiet state). GPO/RF_USER remains high-Z.

ManageGPO command

GPO/RF_USER (OD)

5) VCD sends any command other than ManageGPO command and ST25DV replies.

GPO/RF_USER remains high-Z.

Any other command

F t1/Wt S

ST25DV reply

GPO/RF_USER (OD) page 28/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_ACTIVITY :

•

GPO output level reflects the RF activity.

When RF_ACTIVITY is activated, a GPO output level change from RF command EOF to ST25DV response

EOF.

Figure 13. RF_ACTIVITY chronogram

1) VCD sends a command and ST25DV replies. GPO/RF_ACTIVITY is released after ST25DV response.

VCD command

F t

ST25DV reply

GPO/RF_ACTIVITY (OD)

2) VCD sends a write command and ST25DV replies after write completed. GPO/RF_ACTIVITY is released after ST25DV response.

Write command

(m*)W t

ST25DV reply

GPO/RF_ACTIVITY (OD)

3) VCD sends a write command with option flag set to 1, and ST25DV replies after receiving EOF.

GPO/RF_ACTIVITY is released after ST25DV response.

Write command

>(m*)W t

F t

ST25DV reply

GPO/RF_ACTIVITY (OD)

4) VCD sends an Inventory 16 slots command, and ST25DV replies in its slot. GPO/RF_ACTIVITY is released after ST25DV response.

Inventory command

Slot 1

Slot n t

ST25DV reply

GPO/RF_ACTIVITY (OD)

5) VCD sends a command and ST25DV stays quiet (Stay Quiet command, command not for this

VICC, or quiet state). GPO/RF_ACTIVITY remains high-Z.

VCD

Command

GPO/RF_ACTIVITY (OD) page 29/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_INTERRUPT:

•

A pulse is emitted on GPO by Manage GPO command (interrupt).

When RF_INTERRUPT is activated, a pulse of duration IT_TIME is emitted after EOF of ST25DV response to a Manage GPO interrupt command (see

Section 7.6.30 Manage GPO ).

Figure 14. RF_INTERRUPT chronogram

1) VCD sends a ManageGPO command with value 80h (GPO emit pulse) and ST25DV replies.

GPO/RF_INTERRUPT generates a pulse of duration IT_TIME after ST25DV response.

ManageGPO

80h command

F t

ST25DV reply

GPO/RF_INTERRUPT (OD)

2) VCD sends a ManageGPO command (any value) and ST25DV replies with error.

GPO/RF_INTERRUPT remains high-Z.

ManageGPO command

F t

ST25DV reply

GPO/RF_INTERRUPT (OD)

3) VCD sends a ManageGPO command (any value) and ST25DV stays quiet (command not for this

VICC, or quiet state). GPO/RF_INTERRUPT remains high-Z.

ManageGPO command

GPO/RF_INTERRUPT (OD)

4) VCD sends any command other than ManageGPO command and ST25DV replies.

GPO/RF_INTERRUPT remains high-Z.

Any other command

F t

/W t

ST25DV reply

GPO/RF_INTERRUPT (OD) page 30/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

•

FIELD_CHANGE:

•

A pulse is emitted on GPO to signal a change in RF field state.

When FIELD_CHANGE is activated, and when RF field appear or disappear, GPO emits a pulse of duration

IT_TIME.

In case of RF field disappear, the pulse is emitted only if V

power supply is present.

If RF is configured in RF_SLEEP mode, field change are not reported on GPO, even if FIELD_CHANGE event is activated, as shown in

Table 22. FIELD_CHANGE when RF is disabled or in sleep mode

Table 22. FIELD_CHANGE when RF is disabled or in sleep mode

RF_DISABLE

RF_SLEEP

GPO behaviour when FIELD_CHANGE is enabled

A pulse is emitted on GPO if RF field appears or disappears

GPO remains High-Z (OD) or tied low (CMOS)

IT_STS_Dyn register is not updated.

1. assuming that GPO output is enabled (GPO_EN = 1).

Figure 15. FIELD_CHANGE chronogram

1) RF field appears. GPO/FIELD_CHANGE generates a pulse during IT_TIME.

RF field

First VCD command

F t

GPO/FIELD_CHANGE (OD)

ST25DV reply

2) RF field disappears and ST25DV is powered through VCC. GPO/FIELD_CHANGE generates a pulse during IT_TIME.

RF field

VCD command

F t

ST25DV reply

GPO/FIELD_CHANGE (OD)

3) RF field disappears and ST25DV is not powered through VCC. GPO/FIELD_CHANGE doesn’t generates any pulse.

RF field

VCD command

GPO/FIELD_CHANGE (OD)

F t

ST25DV reply

F page 31/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_PUT_MSG:

•

A pulse is emitted on GPO when a message is successfully written by RF in fast transfer mode mailbox.

When RF_PUT_MSG is activated, a pulse of duration IT_TIME is emitted on GPO at completion of valid

Write Message or Fast Write Message commands (after EOF of ST25DV response).

Figure 16. RF_PUT_MSG chronogram

1) VCD sends a Write Message or Fast Write Message command and ST25DV replies with no error.

GPO/RF_PUT_MSG generates a pulse during IT_TIME after ST25DV response.

Write Msg command

F t1 S

ST25DV reply

GPO/RF_PUT_MSG (OD)

2) VCD sends a Write Message or Fast Write Message command and ST25DV replies with error.

GPO/RF_PUT_MSG remains high-Z.

Write Msg command

F t1 S

ST25DV reply

GPO/RF_PUT_MSG (OD)

3) VCD sends Write Message or Fast Write Message command and ST25DV stays quiet (command

not for this VICC, or quiet state). GPO/RF_PUT_MSG stays high-Z.

Write Msg

Command

GPO/RF_PUT_MSG (OD)

4) VCD sends a any other command than Write Message or Fast Write Message commands and

ST25DV replies. GPO/RF_PUT_MSG remains high-Z.

Any other command

F t1 S

ST25DV reply

GPO/RF_PUT_MSG (OD) page 32/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_GET_MSG:

•

A pulse is emitted on GPO when RF has successfully read a message, up to its last byte, in fast transfer mode mailbox.

When RF_GET_MSG is activated, a pulse of duration IT_TIME is emitted on GPO at completion of valid

Read Message or Fast Read Message commands (after EOF of ST25DV response), and end of message has been reached.

Figure 17. RF_GET_MSG chronogram

1) VCD sends a Read Message or Fast Read Message command and ST25DV replies with no error.

GPO/RF_GET_MSG generates a pulse during IT_TIME after ST25DV response.

Read Msg command

F t1 S

ST25DV reply

GPO/RF_GET_MSG (OD)

2) VCD sends a Read Message or Fast Read Message command and ST25DV replies with error.

GPO/RF_GET_MSG remains high-Z.

Read Msg command

F t1 S

ST25DV reply

GPO/RF_GET_MSG (OD)

3) VCD sends Read Message or Fast Read Message command and ST25DV stays quiet (command not for this VICC, or quiet state). GPO/RF_GET_MSG stays high-Z.

Read Msg

Command

GPO/RF_GET_MSG (OD)

4) VCD sends any other command than Read Message or Fast Read Message commands and

ST25DV replies. GPO/RF_GET_MSG remains high-Z.

Any other command

F t1 S

ST25DV reply

GPO/RF_GET_MSG (OD) page 33/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

GPO

RF_WRITE:

•

When RF_WRITE is activated, a pulse of duration IT_TIME is emitted at completion of a valid RF write operation in EEPROM (after EOF of ST25DV response).

Following commands trigger the RF_WRITE interrupt after a valid write operation in EEPROM:

– Write Single Block

– Extended Write Single Block

– Write Multiple Block

– Extended Write Multiple Block

– Lock Block

– Extended Lock Block

– Write AFI

– Lock AFI

– Write DSFID

– Lock DSFID

– Write Configuration

– Write Password

Note that writing in dynamic registers or fast transfer mode mailbox does not trigger RF_WRITE interrupt (no write operation in EEPROM).

Figure 18. RF_WRITE chronogram

1) VCD sends a write command and ST25DV replies after write completed. GPO/RF_WRITE generates a pulse during IT_TIME after ST25DV response.

Write command

(m*)W t

ST25DV reply

GPO/RF_WRITE (OD)

2) VCD sends a write command with option flag set to 1, and ST25DV replies after receiving EOF.

GPO/RF_WRITE generates a pulse during IT_TIME after ST25DV response.

Write command

>(m*)W t

F t

ST25DV reply

GPO/RF_WRITE (OD)

3) VCD sends a write command and ST25DV replies with error. GPO/RF_WRITE remains high-Z.

Write command

F t

ST25DV reply

GPO/RF_WRITE (OD)

4) VCD sends any other command than a write command. GPO/RF_WRITE remains high-Z.

Any other command

F t

ST25DV reply

GPO/RF_WRITE (OD)

5) VCD sends any command and ST25DV stays quiet (command not for this VICC, or quiet state).

RF_ACTIVITY remains high-Z.

VCD

Command

GPO/RF_WRITE (OD) page 34/200

5.2.2

ST25DV04K ST25DV16K ST25DV64K

GPO

GPO and power supply

When at the same time RF field is present and V

is ON, GPO is acting as configured in GPO, GPO_CTRL_Dyn and IT_TIME registers.

When the RF field disappears, the GPO state is reset and the output level is set to high-Z (open drain) or tied low

(CMOS). Interruption status in IT_STS_Dyn register is maintained until next I 2 C read or V

power off.

Table 23. GPO interrupt capabilities in function of RF field

RF field on

GPO state is function of RF events

RF field off

GPO remains High-Z (OD) or tied low (CMOS)

1. If pull-up resistor is powered (Open Drain-IE version), and V

DCG

is powered (CMOS –JF version).

When V

is not present, or ST25DVxxx is in low power mode, all events are available on GPO pin, assuming pull-up resistor is supplied with correct voltage (Open Drain-IE version) or V

DCG

is powered (CMOS-JF version).

The host can be waken up using GPO interrupt in any power condition.

The exception is FIELD_CHANGE when RF field is falling, which can’t be reported on GPO output if V

is off or in low power mode (no power supply on ST25DVxxx).

Table 24. GPO interrupt capabilities in function of V

power supply

GPO events V

OFF

ON and LPD high (1)

(low power mode)

ON and LPD low

FIELD_CHANGE if RF field disappears

Any other activated RF event

GPO remains High-Z (OD) or tied low (CMOS)

GPO state is function of RF events

GPO remains High-Z (OD) or tied

low (CMOS) (2)

Pulse emitted on GPO

GPO state is function of RF events

GPO state is function of

RF events

Table 11. System configuration memory map for the GPO register.

1. For STM25DVxxK-JF only.

2. If pull-up resistor is powered (Open Drain-IE version) and V

DCG

is powered (CMOS-JF version).

(1)

DS10925 - Rev 9 page 35/200

ST25DV04K ST25DV16K ST25DV64K

GPO

5.2.3

•

GPO registers

Four registers are dedicated to this feature:

Two static registers in system configuration

Two dynamic registers

Table 25. GPO access

Command

Read Configuration (cmd code A0h) @00h

Write Configuration (cmd code A1h) @00h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2=1, 0000h

I2C

Type

R always, W if I 2 C security session is open

Bit b0 b1 b2 b3 b4 b5 b6 b7

Note:

Name

RF_USER_EN

RF_ACTIVITY_EN

RF_INTERRUPT_EN

FIELD_CHANGE_EN

RF_PUT_MSG_EN

RF_GET_MSG_EN

RF_WRITE_EN

GPO_EN

Table 26. GPO

Function

0: disabled

1: GPO output level is controlled by Manage GPO Command (set/reset)

0: disabled

1: GPO output level changes from RF command EOF to response EOF.

0: disabled

1: GPO output level is controlled by Manage GPO Command (pulse).

0: disabled

1: A pulse is emitted on GPO, when RF field appears or disappears.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF Write Message command.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF Read Message command if end of message has been reached.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF write operation in

EEPROM.

0: GPO output is disabled. GPO is High-Z (open drain) or 0 (CMOS)

1: GPO output is enabled. GPO outputs enabled interrupts.

Factory Value

Refer to

•

Enables the interruption source, and enable GPO output.

Several interruption sources can be enabled simultaneously.

The updated value is valid for the next command (except for the RF_WRITE interrupt, which is valid right after EOF of the Write Configuration command if enabled through RF).

The GPO_EN bit (b7) allows to disable GPO output (High-Z for open drain version, driven low for CMOS version). Interruptions are still reported in IT_STS_Dyn register.

RF configuration security session (present RF password 0) or I 2 C security session (present I 2 C password) must be open in order to write the GPO register.

DS10925 - Rev 9 page 36/200

ST25DV04K ST25DV16K ST25DV64K

GPO

Table 27. IT_TIME access

Command

Read Configuration (cmd code A0h) @01h

Write Configuration (cmd code A1h) @01h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2=1, 0001h

I2C

Type

R always, W if I 2 session is open

C security

Bit b2-b0 b7-b3

Note:

Name

IT_TIME

RFU

Table 28. IT_TIME

Function

Pulse duration = 301 us - IT_TIME x 37.65 us ± 2 us

Factory Value

011b

00000b

•

Refer to

Table 11. System configuration memory map for the IT_TIME register.

• Defines interrupt pulse duration on GPO pin for the flowing events: RF_INTERRUPT, FIELD_CHANGE,

RF_PUT_MSG, RF_GET_MSG and RF_WRITE.

See Eq. (1) for interrupt duration calculation.

RF configuration security session (present RF password 0) or I 2 C security session (present I 2 C password) must be open in order to write IT_TIME register.

Table 29. GPO_CTRL_Dyn access

Command

Read Dynamic Configuration (cmd code ADh) @00h

Fast Read Dynamic Configuration (cmd code CDh) @00h

Type

Address

E2 = 0, 2000h

I2C

Type b0-b6: RO b7 : R always, W always

DS10925 - Rev 9 page 37/200

ST25DV04K ST25DV16K ST25DV64K

GPO

Bit b0 b1 b2 b3 b4 b5 b6 b7

Note:

Name

RF_USER_EN

RF_ACTIVITY_EN

RF_INTERRUPT_EN

FIELD_CHANGE_EN

RF_PUT_MSG_EN

RF_GET_MSG_EN

RF_WRITE_EN

GPO_EN

Table 30. GPO_CTRL_Dyn

Function

0: disabled

1: GPO output level is controlled by Manage GPO Command (set/reset)

0: disabled

1: GPO output level changes from RF command EOF to response EOF.

0: disabled

1: GPO output level is controlled by Manage GPO Command (pulse).

0: disabled

1: A pulse is emitted on GPO, when RF field appears or disappears.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF Write Message command.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF Read Message command if end of message has been reached.

0: disabled

1: A pulse is emitted on GPO at completion of valid RF write operation in

EEPROM.

0: GPO output is disabled. GPO is High-Z (open drain) or 0 (CMOS)

1: GPO output is enabled. GPO outputs enabled interrupts.

Factory Value

•

Refer to

Table 12. Dynamic registers memory map for the GPO_CTRL_Dyn register.

Allows I

C host to dynamically enable or disable GPO output by writing in GPO_EN bit (b7).

GPO_EN bit of GPO_CTRL_Dyn register is prevalent over GPO_EN bit of GPO register.

At power up, and each time GPO register is updated, GPO_CTRL_Dyn content is copied from GPO register.

GPO_CTRL_Dyn is a volatile register. Value is maintained only if at least one of the two power sources is present (RF field or V

•

GPO_CTRL_Dyn bit 7 (GPO_EN) can be written even if I 2 C security session is closed (I 2 C password not presented) but is read only for RF user.

Modifying GPO_CTRL_Dyn, the bit 7 GPO_EN does not affect the value of GPO register bit 7 GPO_EN

Command

No access

Table 31. IT_STS_Dyn access

Type

I2C

Address

E2 = 0, 2005h

Type

DS10925 - Rev 9 page 38/200

ST25DV04K ST25DV16K ST25DV64K

GPO

Note: b4 b5 b2 b3

Bit b0 b1 b6 b7

Name

RF_USER

RF_ACTIVITY

RF_INTERRUPT

FIELD_FALLING

FIELD_RISING

RF_PUT_MSG

RF_GET_MSG

RF_WRITE

Table 32. IT_STS_Dyn

Function

0: Manage GPO reset GPO

1: Manage GPO set GPO

0: No RF access

1: RF access

0: No Manage GPO interrupt request

1: Manage GPO interrupt request

0: No RF field falling

1: RF Field falling

0: No RF field rising

1: RF field rising

0: No message put by RF in FTM mailbox

1: Message put by RF in FTM mailbox

0: No message read by RF from FTM mailbox

1: Message read by RF from FTM mailbox, and end of message has been reached.

0: No write in EEPROM

1: Write in EEPROM

Factory Value

•

Refer to

Table 12. Dynamic registers memory map for the IT_STS_Dyn register.

• Cumulates all events which generate interruptions. It should be checked by I 2 C host to know which event triggered an interrupt on GPO pin.

• When enabled, RF events are reported in IT_STS_Dyn register even if GPO output is disabled though the

GPO_EN bit.

Once read the ITSTS_Dyn register is cleared (set to 00h).

At power up, IT_STS_Dyn content is cleared (set to 00h).

IT_STS_Dyn is a volatile register. Value is maintained only if at least one of the two power sources is present (RF field or V

DS10925 - Rev 9 page 39/200

ST25DV04K ST25DV16K ST25DV64K

GPO

5.2.4

Configuring GPO

GPO and interruption pulse duration can be configured by RF user or by I

C host. One or more interrupts can be enabled at same time.

RF user can use Read Configuration and Write Configuration commands to set accordingly the GPO and

IT_TIME registers, after presenting a valid RF configuration password to open RF configuration security session.

I 2 C host can write GPO and IT_TIME registers, after presenting a valid I 2 C password to open I 2 C security session.

Enabling or disabling GPO output:

• RF user and I 2 C host can disable or enable GPO output at power up time by writing in GPO_EN bit 7 of

GPO register (if write access is granted).

•

C host can temporarily enable or disable GPO output at any time by toggling GPO_EN bit 7 of

GPO_CTRL_Dyn register. No password is required to write into GPO_CTRL_Dyn register.

Disabling GPO output by writing in GPO_EN bit (either in GPO or in GPO_CTRL_Dyn registers) does not disable interruption report in IT_STS_Dyn status register.

Table 33. Enabling or disabling GPO interruptions

GPO bit 7:

GPO_EN

GPO_CTRL_Dyn bit 7:

GPO_EN

GPO output

GPO remains High-Z (OD) or tied low (CMOS)

Activated RF events are reported on GPO output (1)

1. If pull-up resistor is powered (Open Drain -IE version), and V

DCG

is powered (CMOS –JF version).

Interruption pulse duration configuration:

• Interrupt pulse duration is configured by writing pulse duration value in IT_TIME register.

• Pulse duration is calculated with the following equation

IT pulse duration equation:

ITpulse duration = 301μs − IT_TIME × 37.65μs ± 2μs (1)

DS10925 - Rev 9 page 40/200

ST25DV04K ST25DV16K ST25DV64K

Energy Harvesting (EH)

5.3

5.3.1

Energy Harvesting (EH)

Energy harvesting registers

Command

Read Configuration (cmd code A0h) @02h

Write Configuration (cmd code A1h) @02h

Table 34. EH_MODE access

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1,

0002h

I2C

Type

R always, W if I 2 C security session is open

Bit b0 b7-b1

Note:

Name

EH_MODE

RFU

Table 35. EH_MODE

Function

0: EH forced after boot

1: EH on demand only

Refer to

Table 11. System configuration memory map for the EH_MODE register.

Table 36. EH_CTRL_Dyn access

Command

Read Dynamic Configuration (cmd code ADh) @02h

Fast Read Dynamic Configuration (cmd code CDh) @02h

Write Dynamic Configuration (cmd code AEh) @02h

Fast Write Dynamic Configuration (cmd code CEh) @02h

Type b0: R always, W always b1 - b7: RO

Address

E2=0, 2002h

Factory Value

0000000b

I2C

Type b0: R always, W always b1-b7 : RO

Bit b0 b1 b2 b3 b7-b4

Table 37. EH_CTRL_Dyn

Name

EH_EN

EH_ON

FIELD_ON

VCC_ON

RFU

Function

0: Disable EH feature

1: Enable EH feature

0: EH feature is disabled

1: EH feature is enabled

0: RF field is not detected

1: RF field is present and ST25DVxxx may communicate in RF

0: No DC supply detected on V

pin or Low Power Down mode is forced (LPD is high)

1: V

supply is present and Low Power Down mode is not forced (LPD is low)

Factory Value

Depending of power source

Note: Refer to

Table 12. Dynamic registers memory map for the EH_CTRL_Dyn register.

DS10925 - Rev 9 page 41/200

ST25DV04K ST25DV16K ST25DV64K

Energy Harvesting (EH)

5.3.2

Energy harvesting feature description

The usage of Energy Harvesting element can be defined in configuration register EH_MODE. When the Energy harvesting mode is disabled or the RF field strength is not sufficient, the energy harvesting analog voltage output

V_EH is in High-Z state.

EH_MODE Static Register is used to define the Energy Harvesting default strategy after boot.

At boot EH_EN (in EH_CTRL_Dyn register) is set depending EH_MODE value as shown in table below:

Caution:

EH_MODE

Table 38. Energy harvesting at power-up

EH_EN (at boot)

Energy harvesting at power-up

EH enabled after boot (when possible)

EH disabled initially,

EH delivered on demand (when possible)

Writing 0 in EH_MODE at any time after boot will automatically set EH_EN bit to 1, and thus activate energy harvesting.

Writing 1 in EH_MODE at any time after boot will not modify EH_EN bit (until next reboot) and thus will not modify energy harvesting current state.

•

EH_CTRL_Dyn allows to activate or deactivate on the fly the Energy harvesting (EH_EN) and bring information on actual state of EH and state of power supplies :

•

EH_ON set reflects the EH_EN bit value

FIELD_ON is set in presence of a RF field

VCC_ON is set when Host power supply is on, and low power-down mode is not forced.

During boot, EH is not delivered to avoid alteration in device configuration.

Communication is not guaranteed during EH delivery. Refer to the application note AN4913 (Energy harvesting delivery impact on ST25DVxxx behaviour during RF communication).

Energy harvesting can be set even if ST25DVxxx is in RF disabled or RF Sleep mode, or in Low power mode.

In all these cases, ST25DVxxx will deliver power on V_EH pin if RF field is present. Energy harvesting voltage output is not regulated.

DS10925 - Rev 9 page 42/200

5.3.3

ST25DV04K ST25DV16K ST25DV64K

Energy Harvesting (EH)

EH delivery state diagram

Figure 19. EH delivery state diagram

No EH requested

RF Field ON

Vcc ON Vcc OFF

No EH requested

RF Field OFF

Vcc ON

RF Field OFF

RF Field ON

Vcc OFF

Vcc ON

No EH requested

RF Field ON

Vcc OFF

RF Field OFF

EH requested not delivered

RF Field OFF

Vcc ON

EH_MODE=0

Vcc OFF

Power OFF

RF Field OFF

Vcc OFF

RF Field ON

EH_MODE=1

RF Field ON

EH_MODE=0

RF Field OFF

EH delivered

RF Field ON

Vcc OFF

Vcc ON

RF Field OFF

Vcc OFF

EH delivered

RF Field ON

Vcc ON

Note: Power is delivered on V_EH only if harvested energy is sufficient to supply ST25DV and leave over power.

Grey color indicates the states where power is delivered on V_EH pin.

DS10925 - Rev 9 page 43/200

ST25DV04K ST25DV16K ST25DV64K

Energy Harvesting (EH)

5.3.4

EH delivery sequence

Figure 20. ST25DVxxx Energy Harvesting Delivery Sequence

Boot

Vcc

Field (1)

Boot

With EH_MODE=0 :

EH_EN

EH_ON

Reset

EH_EN

V_EH (2)

With EH_MODE=1 :

Set

EH_EN

EH_ON

Reset

EH_EN

V_EH (2)

Set

EH_EN

Reset

EH_EN

Set

EH_EN

Reset

EH_EN

Set

EH_EN

Set

EH_EN

We suppose that the captured RF power is sufficient to trig EH delivery.

V_EH = 1 means some µW are available on V_EH pin.

V_EH = 0 means V_EH pin is in high-Z.

Reset

EH_EN

Set

EH_EN

DS10925 - Rev 9 page 44/200

ST25DV04K ST25DV16K ST25DV64K

RF management feature

5.4

5.4.1

RF management feature

RF management registers

Table 39. RF_MNGT access

Command

Read Configuration (cmd code A0h) @03h

Write Configuration (cmd code A1h) @03h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 0003h

I2C

Type

R always, W if I 2 session is open

C security

Bit b0 b1 b7-b2

Note:

Name

RF_DISABLE

RF_SLEEP

RFU

Table 40. RF_MNGT

Function

0: RF commands executed

1: RF commands not executed (error 0Fh returned)

0: RF communication enabled

1: RF communication disabled (ST25DV remains silent)

Refer to

Table 11. System configuration memory map for the RF_MNGT register.

Command

Factory Value

000000b

No access

Table 41. RF_MNGT_Dyn access

Type Address

E2 = 0, 2003h

I2C

Type

R always, W always

Bit b0 b1 b7-b2

Note:

Name

RF_DISABLE

RF_SLEEP

RFU

Table 42. RF_MNGT_Dyn

Function

0: RF commands executed

1: RF commands not executed (error 0Fh returned)

0: RF communication enabled

1: RF communication disabled (ST25DV remains silent)

Refer to

Table 12. Dynamic registers memory map for the RF_MNGT_Dyn register.

Factory Value

0000000b

DS10925 - Rev 9 page 45/200

5.4.2

ST25DV04K ST25DV16K ST25DV64K

RF management feature

RF management feature description

RF_MNGT Register is used to control the RF communication between ST25DVxxx and a RF reader.

At boot time, and each time RF_MNGT register it is updated, content of RF_MNGT_Dyn register is copied from RF_MNGT register. The content of RF_MNGT_Dyn register is used during application to set ST25DVxxx behavior.

Content of this dynamic register RF_MNGT_Dyn can be updated on the fly, to temporarily modify the behavior of

ST25DVxxx without affecting the static value of RF_MNGT which will be recovered at next POR.

RF_MNGT register is composed of two bits (see

Table 42. RF_MNGT_Dyn ): RF_DISABLE and RF_SLEEP

For a normal usage of RF interface, bits RF_SLEEP and RF_DISABLE must be set to 0.

For RF are offered three modes:

• RF sleep mode:

– When RF_SLEEP is set to 1, all RF communications are disabled, RF interface doesn’t interpret commands, but minimizes consumption of RF interface.

•

RF disable mode:

– When RF_SLEEP is set to 0 and RF_DISABLE is set to 1, RF commands are interpreted but not executed. In case of a valid command, ST25DVxxx will respond after t

with the error code 0Fh. The

Inventory command is not answered.

RF normal mode:

– In normal usage, RF_SLEEP and RF_DISABLE are set to 0, ST25DVxxx will process the request and respond accordingly when I 2 C is not accessing ST25DVxxx. If I 2 C is busy, ST25DV will respond to RF request with the error code 0Fh.

DS10925 - Rev 9 page 46/200

5.5

ST25DV04K ST25DV16K ST25DV64K

Interface Arbitration

ST25DVxxx automatically arbitrates the exclusive usage of RF and I 2 C interfaces. Arbitration scheme obeys to

“first talk first served” basic law. (see Figure 21. ST25DVxxx, Arbitration between RF and I 2 C

Figure 21. ST25DVxxx, Arbitration between RF and I 2 C

Power OFF

VCC ON or

RF field ON

Boot

RF mute

I2C mute

RF request SOF

Boot done

I2C start

RF busy

(I2C commamds are NoAck)

ST25DV standby

RF free

I2C free

I2C busy

(0Fh or no response to RF requests)

RF transaction terminated I2C transition terminated

RF transaction is terminated:

•

• at response EOF if answer.

at request EOF is no answer.

at RF field OFF.

I2C transaction is terminated:

•

• at the end of EEPROM programming time after the stop condition of a successful write into EEPROM (user memory or system configuration). See

Section 6.4 I2C Write operations

for write time calculation at stop condition for any other I2C transaction at VCC power off at any I2C error (terminated before stop condition) at I2C timeout if it occurs

When RF is busy, I

C interface answers by NoAck on any I

C command.

When I 2 C is busy, RF commands receive no response (Inventory, Stay quiet, addressed commands) or error code

0Fh for any other command.

DS10925 - Rev 9 page 47/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

5.6

Data Protection

ST25DVxxx provides a special data protection mechanism based on passwords that unlock security sessions.

User memory can be protected for read and/or write access and system configuration can be protected from write access, both from RF and I

C assess.

Data protection registers

5.6.1

Table 43. RFA1SS access

Command

Read Configuration (cmd code A0h) @04h

Write Configuration (cmd code A1h) @04h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 0004h

I2C

Type

R always, W if I 2 C security session is open

Bit b1-b0 b3-b2 RW_PROTECTION_A1 b7-b4

Name

PWD_CTRL_A1

RFU

Table 44. RFA1SS

Function

00: Area 1 RF user security session can’t be open by password

01: Area 1 RF user security session is open by RF_PWD_1

10: Area 1 RF user security session is open by RF_PWD_2

11: Area 1 RF user security session is open by RF_PWD_3

00: Area 1 RF access: Read always allowed / Write always allowed

01: Area 1 RF access: Read always allowed, Write allowed if RF user security session is open

10: Area 1 RF access: Read always allowed, Write allowed if RF user security session is open

11: Area 1 RF access: Read always allowed, Write always forbidden

Note: Refer to

Table 11. System configuration memory map for the RFA1SS register.

Table 45. RFA2SS access

Command

Read Configuration (cmd code A0h) @06h

Write Configuration (cmd code A1h) @06h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 0006h

Factory Value

00b

0000b

I2C

Type

R always, W if I 2 session is open

C security

DS10925 - Rev 9 page 48/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Bit b1-b0

Name

PWD_CTRL_A2 b3-b2 RW_PROTECTION_A2

Table 46. RFA2SS

Function

00: Area 2 RF user security session can’t be open by password

01: Area 2 RF user security session is open by RF_PWD_1

10: Area 2 RF user security session is open by RF_PWD_2

11: Area 2 RF user security session is open by RF_PWD_3

00: Area 2 RF access: Read always allowed, Write always allowed

01: Area 2 RF access: Read always allowed, Write allowed if RF user security session is open

10: Area 2 RF access: Read allowed if RF user security session is open, Write allowed if RF user security session is open

11: Area 2 RF access: Read allowed if RF user security session is open, Write always forbidden

Note: Refer to

Table 11. System configuration memory map for the RFA2SS register.

Table 47. RFA3SS access

Command

Read Configuration (cmd code A0h) @08h

Write Configuration (cmd code A1h) @08h

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 0008h

Factory Value

00b

I2C

Type

R always, W if I 2 session is open

C security

Bit b1-b0 b3-b2 RW_PROTECTION_A3 b7-b4

Name

PWD_CTRL_A3

RFU

Table 48. RFA3SS

Function

00: Area 3 RF user security session can’t be open by password

01: Area 3 RF user security session is open by RF_PWD_1

10: Area 3 RF user security session is open by RF_PWD_2

11: Area 3 RF user security session is open by RF_PWD_3

00: Area 3 RF access: Read always allowed / Write always allowed

01: Area 3 RF access: Read always allowed, Write allowed if RF user security session is open

10: Area 3 RF access: Read allowed if RF user security session is open, Write allowed if RF user security session is open

11: Area 3 RF access: Read allowed if RF user security session is open, Write always forbidden

Note: Refer to

Table 11. System configuration memory map for the RFA3SS register.

Table 49. RFA4SS access

Command

Read Configuration (cmd code A0h) @0Ah

Write Configuration (cmd code A1h) @0Ah

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 000Ah

Factory Value

00b

0000b

I2C

Type

R always, W if I 2 C security session is open

DS10925 - Rev 9 page 49/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Bit b1-b0 b3-b2 RW_PROTECTION_A4 b7-b4

Name

PWD_CTRL_A4

RFU

Table 50. RFA4SS

Function

00: Area 4RF user security session can’t be open by password

01: Area 4 RF user security session is open by RF_PWD_1

10: Area 4 RF user security session is open by RF_PWD_2

11: Area 4 RF user security session is open by RF_PWD_3

00: Area 4 RF access: Read always allowed, Write always allowed

01: Area 4 RF access: Read always allowed, Write allowed if RF user security session is open

10: Area 4 RF access: Read allowed if RF user security session is open, Write allowed if RF user security session is open

11: Area 4 RF access: Read allowed if RF user security session is open, Write always forbidden

Note: Refer to

Table 11. System configuration memory map for the RFA4SS register.

Table 51. I2CSS access

Command

No access

Type Address

E2 = 1, 000Bh

Factory Value

00b

0000b

I2C

Type

R always, W if I 2 C security session is open

DS10925 - Rev 9 page 50/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Bit Name b1-b0 RW_PROTECTION_A1 b3-b2 RW_PROTECTION_A2 b5-b4 RW_PROTECTION_A3 b7-b6 RW_PROTECTION_A4

Table 52. I2CSS

Function

00: Area 1 I 2 C access: Read always allowed, Write always allowed

01: Area 1 I 2 C access: Read always allowed, Write allowed if I 2 C user security session is open

10: Area 1 I 2 C access: Read always allowed, Write always allowed

11: Area 1 I 2 C access: Read always allowed, Write allowed if I 2 session is open

C user security

00: Area 2 I 2 C access: Read always allowed, Write always allowed

01: Area 2 I 2 C access: Read always allowed, Write allowed if I 2 C user security session is open

10: Area 2 I 2 C access: Read allowed if I 2 C user security session is open, Write always allowed

11: Area 2 I 2 C access: Read allowed if I 2 C security session is open, Write allowed if I 2 C security session is open

00: Area 3 I 2 C access: Read always allowed, Write always allowed

01: Area 3 I 2 C access: Read always allowed, Write allowed if I 2 C user security session is open

10: Area 3 I 2 C access: Read allowed if I 2 C user security session is open, Write always allowed

11: Area 3 I 2 C access: Read allowed if I 2 C security session is open, Write allowed if I 2 C security session is open

00: Area 4 I 2 C access: Read always allowed, Write always allowed

01: Area 4 I 2 C access: Read always allowed, Write allowed if I 2 C user security session is open

10: Area 4 I 2 C access: Read allowed if I 2 C user security session is open, Write always allowed

11: Area 4 I 2 C access: Read allowed if I 2 C security session is open, Write allowed if I 2 C security session is open

Note: Refer to

Table 11. System configuration memory map for the I2CSS register.

Factory Value

00b

DS10925 - Rev 9 page 51/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Table 53. LOCK_CCFILE access

Command

Lock Block (cmd code 22h) @00h/01h

Ext Lock Block (cmd code 32h) @00h/01h

Read Block (cmd code 20h) @00h/01h

Fast Read Block

(1) (cmd code C0h) @00h/01h

Ext Read Block

(1) (cmd code 30h) @00h/01h

Fast Ext Read Block (1)

(cmd code C4h) @00h/01h

Read Multi Block

(1) (cmd code 23h) @00h/01h

Ext Read Multi Block (1)

(cmd code 33h) @00h/01h

Fast Read Multi Block (1)

(cmd code C3h)

@00h/01h

Fast Ext Read Multi Block

Table 11. System configuration memory map for the LOCK_CCFILE register.

(cmd code C5h)

@00h/01h

Get Multi Block SS (cmd code 2Ch) @00h/01h

Ext Get Multi Block SS (cmd code 3Ch) @00h/01h

1. With option flag set to 1.

Type Address

R always b0: W if Block 00h is not already locked, b1: W if Block 01h is not already locked.

E2 = 1, 000Ch

I2C

Type

R always, W if I 2 C security session is open

Bit b0 b1 b7-b2

Note:

Name

LCKBCK0

LCKBCK1

RFU

Table 54. LOCK_CCFILE

Function

0: Block @ 00h is not Write locked

1: Block @ 00h is Write locked

0: Block @ 01h is not Write locked

1: Block @ 01h is Write locked

Refer to

Table 55. LOCK_CFG access

Command

Read Configuration (cmd code A0h) @0Fh

Write Configuration (cmd code A1h) @0Fh

Type

R always, W if RF configuration security session is open and configuration not locked

Address

E2 = 1, 000Fh

Factory Value

000000b

I2C

Type

R always, W if I 2 session is open

C security

Bit b0 b7-b1

Note:

Name

LCK_CFG

RFU

Table 56. LOCK_CFG

Function

0: Configuration is unlocked

1: Configuration is locked

Refer to

Table 11. System configuration memory map for the LOCK_CFG register.

Factory Value

0000000b

DS10925 - Rev 9 page 52/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Table 57. I2C_PWD access

Command Type Address

No access

E2 = 1, 0900h to 0907h, Present/Write password command format.

I2C

Type

R if I 2 C security session is open, W if I 2 C security session is open

I2C address

0900h

0901h

0902h

0903h

0904h

0905h

0906h

0907h

Note:

Bit b7-b0 b7-b0 b7-b0 b7-b0 b7-b0 b7-b0 b7-b0 b7-b0

Name

I2C_PWD

Table 58. I2C_PWD

Function

Byte 7 (MSB) of password for I 2 C security session

Byte 6 of password for I 2 C security session

Byte 5 of password for I 2 C security session

Byte 4 of password for I 2 C security session

Byte 3 of password for I 2 C security session

Byte 2 of password for I 2 C security session

Byte 1 of password for I 2 C security session

Byte 0 (LSB) of password for I 2 C security session

Refer to

Table 11. System configuration memory map for the I2C_PWD register.

Command

Present Password (cmd code B3h)

Write Password (cmd code B1h)

Table 59. RF_PWD_0 access

Type

WO if RF configuration security session is open

Address

I2C

Type

No access

Factory

Value

00h

Note:

Bit b7-b0

Name

RF_PWD_0

Table 60. RF_PWD_0

Function

Byte 0 (LSB) of password for RF configuration security session

Byte 1 of password for RF configuration security session

Byte 2 of password for RF configuration security session

Byte 3 of password for RF configuration security session

Byte 4 of password for RF configuration security session

Byte 5 of password for RF configuration security session

Byte 6 of password for RF configuration security session

Byte 7 (MSB) of password for RF configuration security session

Refer to

Table 11. System configuration memory map for the RF_PWD_0 register.

Factory Value

00h

DS10925 - Rev 9 page 53/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Command

Present Password (cmd code B3h)

Write Password (cmd code B1h)

Table 61. RF_PWD_1 access

Type

WO if RF configuration security session is open with RF password 1

Address

No access

Note:

Bit b7-b0

Name

RF_PWD_2

Table 64. RF_PWD_2

Function

Byte 0 (LSB) of password 2 for RF user security session

Byte 1 of password 2 for RF user security session

Byte 2 of password 2 for RF user security session

Byte 3 of password 2 for RF user security session

Byte 4 of password 2 for RF user security session

Byte 5 of password 2 for RF user security session

Byte 6 of password 2 for RF user security session

Byte 7 (MSB) of password 2 for RF user security session

Refer to

Table 11. System configuration memory map for the RF_PWD_2 register.

I2C

Type

Note:

Bit b7-b0

Name

RF_PWD_1

Table 62. RF_PWD_1

Function

Byte 0 (LSB) of password 1 for RF user security session

Byte 1 of password 1 for RF user security session

Byte 2 of password 1 for RF user security session

Byte 3 of password 1 for RF user security session

Byte 4 of password 1 for RF user security session

Byte 5 of password 1 for RF user security session

Byte 6 of password 1 for RF user security session

Byte 7 (MSB) of password 1 for RF user security session

Refer to

Table 11. System configuration memory map for the RF_PWD_1 register.

Command

Present Password (cmd code B3h)

Write Password (cmd code B1h)

Table 63. RF_PWD_2 access

Type

WO if RF user security session is open with RF password 2

Address

No access

I2C

Type

Factory Value

00h

Factory Value

00h

DS10925 - Rev 9 page 54/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Command

Present Password (cmd code B3h)

Write Password (cmd code B1h)

Table 65. RF_PWD_3 access

Type

WO if RF user security session is open with RF password 3

Address

No access

I2C

Type

Note:

Bit b7-b0

Name

RF_PWD_3

Table 66. RF_PWD_3

Function

Byte 0 (LSB) of password 3for RF user security session

Byte 1 of password 3 for RF user security session

Byte 2 of password 3 for RF user security session

Byte 3 of password 3 for RF user security session

Byte 4 of password 3 for RF user security session

Byte 5 of password 3 for RF user security session

Byte 6 of password 3 for RF user security session

Byte 7 (MSB) of password 3 for RF user security session

Refer to

Table 11. System configuration memory map for the RF_PWD_3 register.

Table 67. I2C_SSO_Dyn access

No access

Command Type Address

E2 = 0, 2004h

I2C

Type

Factory Value

00h

Note:

5.6.2

Bit b7-b1 b0

Name

RFU

I2C_SSO

Table 68. I2C_SSO_Dyn

Function

0: I 2 C security session close

1: I 2 C security session open

(Set or reset via I 2 C Present password command)

Factory Value

Refer to

Table 12. Dynamic registers memory map for the I2C_SSO_Dyn register.

Passwords and security sessions

ST25DVxxx provides protection of user memory and system configuration static registers. RF user and I 2 C host can access those protected data by opening security sessions with the help of passwords. Access rights is more restricted when security sessions are closed, and less restricted when security sessions are open.

Dynamic registers and fast transfer mode mailbox are not protected by any security session.

There is three type of security sessions, as shown in Table 69. Security session type :

DS10925 - Rev 9 page 55/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Table 69. Security session type

Security session

RF user

RF configuration

I 2 C

Open by presenting

I 2 C password

(I2C_PWD)

Right granted when security session is open, and until it is closed

RF password 1, 2 or 3

(RF_PWD_1, RF_PWD_2,

RF_PWD_3)

RF password 0

(RF_PWD_0)

RF user access to protected user memory as defined in RFA i

SS registers

RF user write access to RF password 1, 2 or 3

Section 7.6.35 Write Password .

RF user write access to configuration static registers

RF user write access to RF password 0

I 2 C host access to protected user memory as defined in I2CSS register

I 2 C host write access to configuration static registers

I 2 C host write access to I 2 C password

1. Password number must be the same as the one selected for protection.

2. Write access to the password number corresponding to the password number presented.

Caution:

All passwords are 64-bits long, and default factory passwords value is 0000000000000000h.

The ST25DVxxx passwords management is organized around RF and I 2 C dedicated set of commands to access the dedicated registers in system configuration area where password values are stored.

The dedicated password commands in RF mode are:

• Write Password command (code B1h): see

•

Present Password command (code B3h): see Section 7.6.36 Present Password

RF user possible actions for security sessions are:

• Open RF user security session valid corresponding password

: Present Password command, with password number 1, 2 or 3 and the

• Write RF password : Present Password command, with password number (0, 1, 2 or 3) and the current valid corresponding password. Then Write Password command, with same password number (0, 1, 2 or 3) and the new corresponding password.

•

Close RF user security session : Present Password command, with a different password number than the one used to open session or any wrong password. Or remove tag from RF field (POR). Presenting a password with an invalid password number doesn't close the session.

Open RF configuration security session : Present Password command, with password number 0 and the valid password 0.

Close RF configuration security session : Present Password command, with a password number different than 0, or password number 0 and wrong password 0. Or remove tag from RF field (POR). Presenting a password with an invalid password number doesn't close the session.

Opening any new RF security session (user or configuration) automatically close the previously open one (even if it fails).

There is no interaction between I 2 C and RF security sessions. Both are independent, and can run in parallel.

If ST25DVxxx is powered through V

, removing V

during a RF command can abort the command. As a consequence, before writing a new password, RF user should check if V

is ON, by reading EH_CTRL_Dyn register bit 3 (VCC_ON), and eventually ask host to maintain or to shut down V

, before issuing the Write

Password command in order to avoid password corruption.

To make the application more robust, it is recommended to use addressed or selected mode during write password operations to get the traceability of which tags/UID have been programmed.

DS10925 - Rev 9 page 56/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Figure 22. RF security sessions management

ST25DV out of RF field

RF field ON

Present any RF password not OK (1)

Any other command

All RF security sessions closed

Present

RF_PWD_x OK

Any other command

Present

RF_PWD_x OK

RF security session x opened

(y closed)

Present

RF_PWD_y OK

RF security session y opened

(x closed)

1. Presenting a password with an invalid password number doesn't close the session.

RF field OFF

The dedicated password commands in I 2 C mode are:

• I 2

C Write Password command: see Section 6.6.2 I2C write password command description

• I 2 C Present Password command: see

Section 6.6.1 I2C present password command description .

I 2 C host possible actions for security sessions are:

• Open I 2 C security session : I 2 C Present Password command with valid I 2 C password.

•

Write I 2 C password : I 2 C Present Password command with valid I 2 C password. Then I 2 C Write Password command with new I 2 C password.

Close I 2 C security session : I 2 C Present Password command with wrong I 2 C password. Or remove tag

power supply (POR).

Check if I 2 C security session is open : I 2 C host can read the current status (open or closed) of I 2 C security session by reading the I2C_SSO_Dyn register.

There is no interaction between I 2 C and RF security sessions. Both are independent and can run in parallel.

DS10925 - Rev 9 page 57/200

ST25DV04K ST25DV16K ST25DV64K

Data Protection

Figure 23. I 2 C security sessions management

VCC OFF

VCC ON

Any other command

Present

I2C security session closed

I2C_SSO=00h

I2C_PWD not OK

Present

I2C_PWD

Any other command

I2C security session opened

I2C_SSO=01h

VCC

OFF

5.6.3

Note:

User memory protection

On factory delivery, areas are not protected.

Each area can be individually protected in read and/or write access from RF and I 2 C.

Area 1 is always readable (from RF and I 2 C).

Furthermore, RF blocks 0 and 1 (I 2 C bytes 0000h to 0007h) can be independently write locked.

User memory protection from RF access

In RF mode, each memory area of the ST25DVxxx can be individually protected by one out of three available passwords (RF password 1, 2 or 3), and each area can also have individual Read/Write access conditions.

For each area, an RFA i

SS register is used to:

• Select the RF password that unlock the RF user security session for this area

• Select the protection against read and write operations for this area

(See Table 44. RFA1SS

Table 46. RFA2SS

Table 48. RFA3SS

, and

Table 50. RFA4SS

for details about available read and write protections).

Setting 00b in PWD_CTRL_A i

field means that RF user security session cannot be open by any password for the corresponding area.

When updating RFA i

SS registers, the new protection value is effective immediately after the register write completion.

DS10925 - Rev 9 page 58/200

Note:

5.6.4

ST25DV04K ST25DV16K ST25DV64K

Data Protection

• Rf blocks 0 and 1 are exceptions to this protection mechanism:

– RF blocks 0 and 1 can be individually write locked by issuing a (Ext) Lock Single Block RF command.

Once locked, they cannot be unlock through RF. LOCK_CCFILE register is automatically updated when using (Ext) Lock Single Block command.

– A RF user needs no password to lock blocks 0 and/or 1.

– Locking blocks 0 and/or 1 is possible even if the configuration is locked (LOCK_CFG=1).

– Locking blocks 0 and/or 1 is possible even if the area is write locked.

– Unlocking area1 (through RFA1SS register) does not unlock blocks 0 and 1 if they have been locked though (Ext) Lock Block command.

– Once locked, the RF user cannot unlock blocks 0 and/or 1 (can be done by I 2 C host).

When areas size are modified (ENDAi registers), RFAiSS registers are not modified.

User memory protection from I 2 C access

In I 2 C mode, each area can also have individual Read/Write access conditions, but only one I 2 C password is used to unlock I 2 C security session for all areas.

The I2CSS register is used to set protection against read and write operation for each area (see

Table 52. I2CSS

for details about available read and write protections).

When updating I2CSS registers, the new protection value is effective immediately after the register write completion.

I 2 C user memory Bytes 0000h to 0003h (RF Block 0) and 0004h to 0007h (RF Block 1) can be individually locked and unlocked by writing in the LOCK_CCFILE register (by group of 4 Bytes), independently of Area 1 protection.

Unlocking Area 1 (through I2CSS register) does not unlock those bytes if they have been locked though the

LOCK_CCFILE register.

When areas size are modified (ENDAi registers), I2CSS register is not modified.

Retrieve the security status of a user memory block or byte

•

RF user can read a block security status by issuing following RF commands:

• (Ext) Get Multiple Blocks Security Status command.

(Ext) (Fast) Read Single Block with option flag set to 1.

(Ext) (Fast) Read Multiple Blocks with option flag set to 1.

ST25DV will respond with a Block security status containing a Lock_bit flag as specified in ISO 15693 standard.

This lock_bit flag is set to one if block is locked against write.

Lock_bit flag value may vary if corresponding RF user security session is open or closed.

I 2 C host can retrieve a block security status by reading the I2CSS register to get security status of the corresponding area and by reading the I2C_SSO_Dyn register to know if I 2 C security session is open or closed.

For blocks 0 and 1 (Bytes 0000h to 0007h in I 2 C user memory), lock status can also be read in the

LOCK_CCFILE register.

System memory protection

By default, system memory (static registers) is write protected, both in RF and I 2 C.

I 2 C host must open the I 2 C security session (by presenting a valid I 2 C password) to enable write access to system configuration static registers.

I 2 C host doesn’t have read or write access to RF passwords.

By default, I 2 C host can read all system configuration static registers (except RF passwords)

In RF, to enable write access to system configuration static registers, RF user must open the RF configuration security session (by presenting a valid RF password 0) and system configuration must not be locked

(LOCK_CFG=00h).

RF doesn’t have read or write access to I 2 C password.

By default, RF user can read all system configuration static registers, except all passwords, LOCK_CCFILE,

LOCK_DSFID and LOCK_AFI.

RF configuration lock:

DS10925 - Rev 9 page 59/200

ST25DV04K ST25DV16K ST25DV64K

Device Parameter Registers

5.7

•

RF write access to system configuration static registers can be locked by writing 01h in the LOCK_CFG register (by RF or I 2 C).

RF user cannot unlock system configuration if LOCK_CFG=01h, even after opening RF configuration security session (only I 2 C host can unlock system configuration).

When system configuration is locked (LOCK_CFG=01h), it is still possible to change RF passwords (0 to 3).

Device identification registers:

• AFI and DFSID registers can be independently locked by RF user, issuing respectively a Lock AFI and a

Lock DSFID command. Lock is definitive: once locked, AFI and DSFID registers cannot be unlocked (either by RF or I 2 C). System configuration locking mechanism (LOCK_CFG=01h) does not lock AFI and DSFID registers.

• Other device identification registers (MEM_SIZE, BLK_SIZE, IC_REF, UID, IC_REV) are read only registers for both RF and I 2 C.

Device Parameter Registers

Command

Lock DSFID (cmd code 2Ah)

Table 70. LOCK_DSFID access

Type

WO if DSFID not locked

Address

E2 = 1, 0010h

I2C

Type

Bit b0 b7-b1

Note:

Name

LOCK_DSFID

RFU

Table 71. LOCK_DSFID

Function

0: DSFID is not locked

1: DSFID is locked

Refer to

Table 11. System configuration memory map for the LOCK_DSFID register.

Command

Lock AFI (cmd code 28h)

Table 72. LOCK_AFI access

Type

WO if AFI not locked

Address

E2 = 1, 0011h

I2C

Type

Factory Value

0000000b

Bit b0 b7-b1

Note:

Name

LOCK_AFI

RFU

Table 73. LOCK_AFI

Function

0: AFI is not locked

1: AFI is locked

Refer to

Table 11. System configuration memory map for the LOCK_AFI register.

Factory Value

0000000b

DS10925 - Rev 9 page 60/200

ST25DV04K ST25DV16K ST25DV64K

Device Parameter Registers

Table 74. DSFID access

Command

Inventory (cmd code 01h)

Get System Info (cmd code 2Bh)

Ext Get System Info (cmd code 3Bh)

Write DSFID (cmd code 28h)

Type

R always, W if DSFID not locked

Address

E2 = 1, 0012h

I2C

Type

Bit b7-b0

Note:

Name

DSFID

Table 75. DSFID

Function

ISO/IEC 15693 Data Storage Format Identifier

Refer to

Table 11. System configuration memory map for the DSFID register.

Table 76. AFI access

Command

Inventory (cmd code 01h)

Get System Info (cmd code 2Bh)

Ext Get System Info (cmd code 3Bh)

Write AFI (cmd code 27h)

Type

R always, W if AFI not locked

Address

E2 = 1, 0013h

I2C

Type

Factory Value

00h

Bit b7-b0

Note:

Name

AFI

Table 77. AFI

Function

ISO/IEC 15693 Application Family Identifier

Refer to

Table 11. System configuration memory map for the AFI register.

Command

Get System Info (cmd code 2Bh) (1)

Ext Get System Info (cmd code 3Bh)

1. Only ST25DV04K-IE and ST25DV04K-JF

Table 78. MEM_SIZE access

Type

Address

E2=1, 0014h to

0015h

I2C

Type

Factory Value

00h

DS10925 - Rev 9 page 61/200

ST25DV04K ST25DV16K ST25DV64K

Device Parameter Registers

I 2 C

Address

0014h

Bit b7-b0

Table 79. MEM_SIZE

Function

0015h b7-b0

Name

MEM_SIZE

Address 0014h: LSB byte of the memory size expressed in RF blocks

Address 0015h: MSB byte of the memory size expressed in RF blocks

Note: Refer to

Table 11. System configuration memory map for the MEM_SIZE register.

Command

Get System Info (cmd code 2Bh) (1)

Ext Get System Info (cmd code 3Bh)

1. Only ST25DV04K-IE and ST25DV04K-JF

Table 80. BLK_SIZE access

Type

Address

E2 = 1, 0016h

I2C

Type

Factory Value

ST25DV04K-xx: 7Fh

ST25DV16K-xx: FFh

ST25DV64K-xx: FFh

ST25DV04K-xx: 00h

ST25DV16K-xx: 01h

ST25DV64K-xx: 07h

Bit b7-b0

Note:

Name

BLK_SIZE

Table 81. BLK_SIZE

Function

RF user memory block size

Refer to

Table 11. System configuration memory map for the BLK_SIZE register.

Table 82. IC_REF access

Command

Get System Info (cmd code 2Bh)

Ext Get System Info (cmd code 3Bh)

Type

I2C

Address

E2 = 1, 0017h

Type

Factory Value

03h

Bit Name

Table 83. IC_REF

Function b7-b0 IC_REF ISO/IEC 15693 IC Reference

Factory Value

ST25DV04K-IE: 24h

ST25DV16K-IE: 26h

ST25DV64K-IE: 26h

ST25DV04K-JF: 24h

ST25DV16K-JF: 26h

ST25DV64K-JF: 26h

Note: Refer to

Table 11. System configuration memory map for the IC_REF register.

DS10925 - Rev 9 page 62/200

ST25DV04K ST25DV16K ST25DV64K

Device Parameter Registers

Table 84. UID access

Command

Inventory (cmd code 01h)

Get System Info (cmd code 2Bh)

Ext Get System Info (cmd code 3Bh)

Type

Address

E2=1, 0018h to

001Fh

I2C

Type

I 2 C

Address

0018h

0019h

001Ah

001Bh

001Ch

Bit b7-b0

001Dh

001Eh

001Fh

Note:

Name

Table 85. UID

Function

ISO/IEC 15693 UID byte 0 (LSB)

ISO/IEC 15693 UID byte 1

ISO/IEC 15693 UID byte 2

ISO/IEC 15693 UID byte 3

ISO/IEC 15693 UID byte 4

Factory Value

IC manufacturer serial number

UID

ISO/IEC 15693 UID byte 5: ST Product code

ISO/IEC 15693 UID byte 6: IC Mfg code

ISO/IEC 15693 UID byte 7 (MSB)

Refer to

Table 11. System configuration memory map for the UID register.

Table 86. IC_REV access

Command

No access

Type Address

E2 = 1, 0020h

I2C

Type

ST25DV04K-IE: 24h

ST25DV16K-IE: 26h

ST25DV64K-IE: 26h

ST25DV04K-JF: 25h

ST25DV16K-JF: 27h

ST25DV64K-JF: 27h

02h

E0h

Bit b7-b0

Note:

Name

IC_REV IC revision

Table 87. IC_REV

Function

Refer to

Table 11. System configuration memory map for the IC_REV register.

Factory Value

Depending on revision

DS10925 - Rev 9 page 63/200

6.1

ST25DV04K ST25DV16K ST25DV64K

I2C operation

I2C operation

I2C protocol

The device supports the I 2 C protocol. This is summarized in

Figure 24. I 2 C bus protocol

. Any device that sends data to the bus is defined as a transmitter, and any device that reads data is defined as a receiver. The device that controls the data transfer is known as the bus master, and the other as the slave device. A data transfer can only be initiated by the bus master, which also provides the serial clock for synchronization. The ST25DVxxx device is a slave in all communications.

Figure 24. I 2 C bus protocol

6.1.1

STOP

Condition

Start condition

Start is identified by a falling edge of serial data (SDA) while the serial clock (SCL) is stable in the high state.

A Start condition must precede any data transfer command. The device continuously monitors (except during a write cycle) the SDA and the SCL for a Start condition, and does not respond unless one is given.

DS10925 - Rev 9 page 64/200

6.1.2

6.1.3

6.1.4

6.2

6.2.1

ST25DV04K ST25DV16K ST25DV64K

I2C timeout

Stop condition

Stop is identified by a rising edge of serial data (SDA) while the serial clock (SCL) is stable and driven high.

A Stop condition terminates communication between the device and the bus master. A Read command that is followed by NoAck can be followed by a Stop condition to force the device into the Standby mode. A Stop condition at the end of a Write command triggers the internal write cycle.

Acknowledge bit (ACK)

The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter, whether a bus master or a slave device, releases the serial data (SDA) after sending eight bits of data. During the 9 th clock pulse period, the receiver pulls the SDA low to acknowledge the receipt of the eight data bits.

Data input

During data input, the device samples serial data (SDA) on the rising edge of the serial clock (SCL). For correct device operation, the SDA must be stable during the rising edge of the SCL, and the SDA signal must change only when the SCL is driven low.

I2C timeout

During the execution of an I²C operation, RF communications are not possible.

To prevent RF communication freezing due to inadvertent indeterminate instructions sent to the I²C bus, the

ST25DVxxx features a timeout mechanism that automatically resets the I²C logic block.

I2C timeout on Start condition

I 2 C communication with the ST25DVxxx starts with a valid Start condition, followed by a device select code.

If the delay between the Start condition and the following rising edge of the serial clock (SCL) that samples the most significant of the Device Select exceeds the t

START_OUT

time (see

Table 248. I 2 C AC characteristics up to

85°C and

Table 248. I 2 C AC characteristics up to 85°C and

), the I²C logic block is reset and further incoming data transfer is ignored until the next valid Start condition.

Figure 25. I²C timeout on Start condition

SCL

SDA t

START_OUT

Start condition

6.2.2

I2C timeout on clock period

During data transfer on the I²C bus, if the serial clock pulse width high (t

CHCL

) or serial clock pulse width low

CLCH

) exceeds the maximum value specified in

Table 249. I 2 C

AC characteristics up to 125°C , the I²C logic block is reset and any further incoming data transfer is ignored until

the next valid Start condition.

DS10925 - Rev 9 page 65/200

6.3

6.4

ST25DV04K ST25DV16K ST25DV64K

Device addressing

To start a communication between the bus master and the slave device, the bus master must initiate a Start condition. Following this, the bus master sends the device select code, shown in

Table 88. Device select code

(on

Serial Data (SDA), the most significant bit first).

The device select code consists of a 4-bit device type identifier and a 3-bit Chip Enable “Address” (E2,1,1). To address the memory array, the 4-bit device type identifier is 1010b. Refer to

Table 88. Device select code

The eighth bit is the Read/Write bit (RW). It is set to 1 for Read and to 0 for Write operations.

Table 88. Device select code b7

Device type identifier

(1)

b6 b5

0 1 0 b4

E2 (2)

Chip Enable address b2 b1

1 1

RW b0

RW Device select code 1

1. The most significant bit, b7, is sent first.

2. E2 is not connected to any external pin. It is however used to address the ST25DVxxx as described in

Section 4 Memory management

• E2 = 0, access to user memory, Dynamic registers or Mailbox.

• E2 =1, access to system area.

If a match occurs on the device select code, the corresponding device gives an acknowledgment on serial data

(SDA) during the ninth bit time. If the device does not match the device select code, it deselects itself from the bus, and goes into Standby mode.

Mode

Current address read

Random address read

Sequential read

Byte write

Sequential write

RW bit

Table 89. Operating modes

Bytes

≥ 1

≤ 256 byte

Initial sequence

Start, device select, RW = 1

Start, device select, RW = 0, address reStart, device select, RW = 1

Similar to current or random address read

Start, device select, RW = 0

I2C Write operations

Following a Start condition, the bus master sends a device select code with the Read/Write bit (RW) reset to 0.

The device acknowledges this, and waits for two address bytes. The device responds to each address byte with an acknowledge bit, and then waits for the data byte.

Each data byte in the memory has a 16-bit (two-byte wide) address. The most significant byte (see

Table 90. Address most significant byte ) is sent first, followed by the least significant byte (see Table 91. Address least significant byte

). Bits b15 to b0 form the address of the byte in memory.

b15 b14 b13

Table 90. Address most significant byte b12 b11 b10 b9 b8 b7 b6 b5

Table 91. Address least significant byte b4 b3 b2 b1 b0

DS10925 - Rev 9 page 66/200

ST25DV04K ST25DV16K ST25DV64K

I2C Write operations

Caution:

6.4.1

6.4.2

When the bus master generates a Stop condition immediately after the Ack bit (in the tenth-bit time slot), either at the end of a byte write or a sequential write, the internal write cycle is triggered. A Stop condition at any other time slot does not trigger the internal write cycle.

After the Stop condition, the delay t

, and the successful completion of a Write operation, the device’s internal address counter is incremented automatically, to point to the next byte address after the last one that was modified.

After an unsuccessful write operation, ST25DVxxx enters in I2C dead state: internal address counter is not incremented, and ST25DVxxx is waiting for a full new I2C instruction (address counter stops to be incremented after the first NoAck bit).

During the internal write cycle, the serial data (SDA) signal is disabled and the device does not respond to any requests.

I 2 C Writing data in user or system memory (EEPROM), transit via the 256-Bytes fast transfer mode's buffer.

Consequently fast transfer mode must be deactivated before starting any write operation in user or system memory, otherwise command will be NotACK, programming is not done and device goes in standby mode.

I2C Byte write

After the device select code and the address bytes, the bus master sends one data byte.

If byte write is not inhibited, the device replies with Ack.

If byte write is inhibited, the device replies with NoAck.

•

The bus master terminates the transfer by generating a Stop condition (see Figure 26. Write mode sequences when write is not inhibited

For byte write in EEPROM (user memory or system configuration), internal programming starts after the Ack, for a duration of t

up to 125°C

(as defined in Table 248. I 2 C AC characteristics up to 85°C and

Table 249. I 2 C AC characteristics

For writes in fast transfer mode buffer or Dynamic registers, internal programming is done at the Ack.

If byte write is inhibited, the device replies with NoAck. The bus master terminates the transfer by generating a

Stop condition and byte location not is modified (see

Figure 27. Write mode sequences when write is inhibited ).

Byte write is inhibited if byte complies with one of the following conditions:

• Byte is in user memory and is write protected with LOCK_CCFILE register.

• Byte is in user memory and is write protected with I2CSS register, and I 2 C security session is closed.

Byte is in user memory and fast transfer mode is activated.

Byte is in system memory and is a Read Only register.

Byte is in system memory and I 2 C security session is closed.

Byte is in fast transfer mode’s mailbox and is not the first Byte of mailbox.

Byte is in fast transfer mode’s mailbox and mailbox is busy.

Byte is in fast transfer mode’s mailbox and fast transfer mode is not activated.

Byte is in dynamic registers area and is a Read Only register.

I2C Sequential write

•

The I 2 C sequential write allows up to 256 bytes to be written in one command, provided they are all located in the same user memory area or are all located in writable addresses.

After each byte is transferred, the internal byte address counter is incremented.

For each byte sent by the bus master:

If byte write is not inhibited, the device replies with Ack.

If byte write is inhibited, the device replies with NoAck.

The transfer is terminated by the bus master generating a Stop condition:

•

For writes in EEPROM (user memory or system configuration), if all bytes have been Ack'ed, internal programming of all bytes starts after the last Ack, for a duration dependent on the number of bytes to write

(see below).

For writes in fast transfer mode buffer or Dynamic registers, if all bytes have been Ack'ed, internal programming is done at the Ack.

• If some bytes have been NotAck’ed, no internal programming is done (0 byte written).

DS10925 - Rev 9 page 67/200

Note:

ST25DV04K ST25DV16K ST25DV64K

I2C Write operations

Byte write is inhibited if byte complies with conditions described in

Section 6.4.1 I2C Byte write

, in addition:

•

Byte is in user memory but does not belong to same area than previous received byte (area border crossing is forbidden).

256 write occurrence have already been reached in the same sequential write.

EEPROM memory (user memory and system configuration) is internally organized in pages of 4 bytes long. Data located in a same page all share the same most significant memory address bits b16-b2.

I 2 C sequential write programming time in the EEPROM memory is dependent on this internal organization: total programming time is the I 2 C write time t

(as defined in

Table 248. I 2 C AC characteristics up to 85°C

and

Table 248. I 2 C AC characteristics up to 85°C and

) multiplied by the number of internal EEPROM pages where the data must be programmed, including incomplete pages. For example, a 256 Bytes I 2 C sequential write, starting at address 0002h will write data over 65 pages. Total write time in this case is t

x 65.

Figure 26. Write mode sequences when write is not inhibited

Byte

Write

ACK ACK ACK

Dev Select Byte address Byte address Data in

ACK

R/W

Sequential

Write

ACK ACK ACK

Dev Select Byte address Byte address Data in 1

ACK

Data in 2

R/W

ACK

Data in N

ACK

N ≤ 256

Figure 27. Write mode sequences when write is inhibited

Byte

Write

Sequential

Write

Dev select

ACK ACK

Byte address Byte address

ACK

Data in

NO ACK

R/W

Dev select

ACK ACK

Byte address Byte address

ACK

Data in 1

NO ACK

Data in 2

R/W

Sequential

Write(cont'd)

NO ACK

Data in N

NO ACK

Note: N ≤ 256

DS10925 - Rev 9 page 68/200

6.4.3

Note:

ST25DV04K ST25DV16K ST25DV64K

I2C Write operations

•

Minimizing system delays by polling on ACK

During the internal write cycle, the device disconnects itself from the bus, and writes a copy of the data from its internal latches to the memory cells. The maximum I²C write time (t w

) is shown in

A dummy write is first performed to load the address into this address counter (as shown in Figure 29. Read mode sequences ) but without sending a Stop condition. Then, the bus master sends another Start condition, and

, but the typical time is shorter.

To make use of this, a polling sequence can be used by the bus master.

The sequence, as shown in

Figure 28 , is:

• Initial condition: a write cycle is in progress.

Step 1: the bus master issues a Start condition followed by a device select code (the first byte of the new instruction).

Step 2: if the device is busy with the internal write cycle, no Ack is returned and the bus master goes back to Step 1. If the device has terminated the internal write cycle, it responds with an Ack, indicating that the device is ready to receive the second part of the instruction (the first byte of this instruction having been sent during Step 1).

There is no need of polling when writing in dynamic registers or in mailbox, since programming time is null.

Figure 28. Write cycle polling flowchart using ACK

Write cycle in progress

Start condition

Device select with RW = 0

NO ACK returned

YES

First byte of instruction with RW = 0 already decoded by the device

Stop

Operation is addressing the memory

YES

Send Address and Receive ACK

StartCondition

YES

Data for the

Write operation

Continue the

Write operation

Device select with RW = 1

Continue the

Random Read operation

DS10925 - Rev 9 page 69/200

6.5

6.5.1

6.5.2

ST25DV04K ST25DV16K ST25DV64K

I2C read operations

Read operation in user memory is performed successfully only if:

• Area to which the byte belongs is not read protected by I2CSS register.

• Area to which the byte belongs is read protected by I2CSS register, but I 2 C security session is open.

Read operations in system memory and dynamic registers are done independently of any protection mechanism, except I2C_PWD register which needs I 2 C security session to be open first.

Read operation in fast transfer mode’s mailbox is performed successfully only if fast transfer mode is activated.

If read is not successful, ST25DVxxx releases the bus and I 2 C host reads byte value FFh.

After the successful completion of a read operation, the device’s internal address counter is incremented by one, to point to the next byte address.

After an unsuccessful read operation, ST25DVxxx enters in I 2 C dead state: internal address counter is not incremented, and ST25DVxxx is waiting for a full new I 2 C instruction.

Random Address Read

repeats the device select code, with the Read/Write bit (RW) set to 1. The device acknowledges this, and outputs the contents of the addressed byte. The bus master must not acknowledge the byte, and terminates the transfer with a Stop condition.

Current Address Read

For the Current Address Read operation, following a Start condition, the bus master only sends a device select code with the Read/Write bit (RW) set to 1. The device acknowledges this, and outputs the byte addressed by the internal address counter. The counter is then incremented. The bus master terminates the transfer with a Stop

condition, as shown in Figure 29. Read mode sequences , without acknowledging the byte.

DS10925 - Rev 9 page 70/200

ST25DV04K ST25DV16K ST25DV64K

I2C read operations

Figure 29. Read mode sequences

Current address read

Random address read

Sequential current read

Sequential random read

Dev sel

ACK

Data out

NO ACK

R/W

Dev sel *

ACK

Byte addr

ACK

Byte addr

ACK

Dev sel *

ACK

Data out

NO ACK

R/W R/W

Dev sel

ACK

Data out 1

ACK

R/W

ACK NO ACK

Data out N

Dev sel *

ACK

Byte addr

ACK

Byte addr

ACK

Dev sel *

ACK

Data out1

ACK

R/W R/W

ACK NO ACK

Data out N

6.5.3

•

Sequential Read access

This operation can be used after a Current Address Read or a Random Address Read. The bus master does acknowledge the data byte output, and sends additional clock pulses so that the device continues to output the next byte in sequence. To terminate the stream of bytes, the bus master must not acknowledge the last byte, and

must generate a Stop condition, as shown in Figure 29. Read mode sequences .

The output data comes from consecutive addresses, with the internal address counter automatically incremented after each byte output.

Sequential read in user memory:

Sequential read cannot cross area borders. After reaching area border, device continues to output FFh

There is no roll over inside area or at the end of user memory (ST25DVxxx returns only FFh after last user memory byte address).

Sequential read in system memory:

• There is no roll over after reaching end of system memory (ST25DVxxx returns only FFh after last system memory byte address).

•

Sequential read in dynamic registers:

It is possible to read sequentially dynamic registers and fast transfer mode’s mailbox (contiguous I 2 C addresses).

DS10925 - Rev 9 page 71/200

ST25DV04K ST25DV16K ST25DV64K

I2C password management

6.5.4

6.6

6.6.1

Sequential read in dynamic registers:

• There is no roll over at the end of the mailbox (ST25DVxxx returns only FFh after last system memory byte address).

Acknowledge in Read mode

For all Read commands, the device waits, after each byte read, for an acknowledgement during the ninth bit time.

If the bus master does not drive serial data (SDA) low during this time, the device terminates the data transfer and switches to its Standby mode.

I2C password management

The ST25DVxxx controls I 2 C security session using an I 2 C 64-bit password. This I 2 C password is managed with two I 2 C dedicated commands: I 2 C present password and I 2 C write password.

I2C present password command description

The I 2 C present password command is used in I 2 C mode to present the password to the ST25DVxxx. This is used to open I 2 C security session or to allow I 2 C password modification (see

Section 5.6 Data Protection

for detailed explanation about password usage).

Following a Start condition, the bus master sends a device select code with the Read/ Write bit (R W ) reset to

0 and the Chip Enable bit E2 at 1. The device acknowledges this, as shown in Figure 30. I 2 C Present Password

Sequence , and waits for two I

2 C password address bytes, 09h and 00h. The device responds to each address byte with an acknowledge bit, and then waits for the eight password data bytes, the validation code, 09h, and a resend of the eight password data bytes. The most significant byte of the password is sent first, followed by the least significant bytes.

It is necessary to send the 64-bit password twice to prevent any data corruption during the sequence. If the two

64-bit passwords sent are not exactly the same, the ST25DVxxx does not start the internal comparison.

When the bus master generates a Stop condition immediately after the Ack bit (during the tenth bit time slot). The

ST25DVxxx compares the 64 received data bits with the 64 bits of the stored I 2 C password. If the values match, the I 2 C security session is open, and the I2C_SSO_Dyn register is set to 01h. If the values do not match, the I 2 C security session is closed and I2C_SSO_dyn register is set to 00h.

I2C_SSO_Dyn is a Dynamic register, it can be checked via I 2 C host to know If I 2 C security session is open.

Figure 30. I 2 C Present Password Sequence

Device select code

Ack

Password

Address 09h

Ack

Password

Address 00h

Ack

Password

[63:56]

Ack

Password

[55:48]

Ack

Password

[47:40]

Ack

Password

[39:32]

Ack

Password

[31:24]

Ack

Password

[23:16]

Ack

Password

[15:8]

Validation code 09h

R/W

Ack

Password

[63:56]

Ack

Password

[55:48]

Ack

Password

[47:40]

Ack

Password

[39:32]

Ack

Password

[31:24]

Password

[23:16]

Ack

Password

[15:08]

Ack

Password

[7:0]

Ack

Device select code = 1010111

Ack generated during 9 th bit time slot.

Password

[7:0]

Ack

6.6.2

I2C write password command description

The I 2 C write password command is used to update the I 2 C password value (register I2C_PWD). It cannot be used to update any of the RF passwords. After the write cycle, the new I 2 C password value is automatically activated. The I 2 C password value can only be modified after issuing a valid I 2 C present password command.

DS10925 - Rev 9 page 72/200

ST25DV04K ST25DV16K ST25DV64K

I2C password management

Caution:

Following a Start condition, the bus master sends a device select code with the Read/ Write bit (R W ) reset to

0 and the Chip Enable bit E2 at 1. The device acknowledges this, as shown in Figure 31. I 2 C Write Password

Sequence , and waits for the two I

2 C password address bytes, 09h and 00h. The device responds to each address byte with an acknowledge bit, and then waits for the four password data bytes, the validation code, 07h, and a resend of the eight password data bytes. The most significant byte of the password is sent first, followed by the least significant bytes.

It is necessary to send twice the 64-bit password to prevent any data corruption during the write sequence. If the two 64-bit passwords sent are not exactly the same, the ST25DVxxx does not modify the I 2 C password value.

When the bus master generates a Stop condition immediately after the Ack bit (during the tenth bit time slot), the internal write cycle is triggered. A Stop condition at any other time does not trigger the internal write cycle.

During the internal write cycle, the serial data (SDA) signal is disabled internally, and the device does not respond to any requests.

I 2 C write password command data transits via the 256-Bytes fast transfer mode's buffer. Consequently fast transfer mode must be deactivated before issuing a write password command, otherwise command is NotACK

(after address LSB), and programming is not done and device goes in standby mode.

Figure 31. I 2 C Write Password Sequence

Device select code

Ack

Password

Address 09h

Ack

Password

Address 00h

Ack

Password

[63:56]

Ack

Password

[55:48]

Ack

Password

[47:40]

Ack

Password

[39:32]

Ack Ack

Password

[31:24]

Password

[23:16]

Ack

Password

[15:08]

Ack

Password

[7:0]

Ack

Validation code 07h

R/W

Ack

Password

[63:56]

Ack

Password

[55:48]

Ack

Password

[47:40]

Ack

Password

[39:32]

Ack

Password

[31:24]

Password

[23:16]

Ack

Password

[15:08]

Ack

Password

[7:0]

Ack

Device select code = 1010111

Ack generated during 9 th bit time slot.

DS10925 - Rev 9 page 73/200

7.1

7.1.1

7.2

7.3

ST25DV04K ST25DV16K ST25DV64K

RF operations

RF operations

Contactless exchanges are performed in RF mode as specified by ISO/IEC 15693 or NFC Forum Type 5.

The ST25DVxxx communicates via the 13.56 MHz carrier electromagnetic wave on which incoming data are demodulated from the received signal amplitude modulation (ASK: amplitude shift keying). The received ASK wave is 10% or 100% modulated with a data rate of 1.6 Kbit/s using the 1/256 pulse coding mode or a data rate of

26 Kbit/s using the 1/4 pulse coding mode.

Outgoing data are generated by the ST25DVxxx load variation using Manchester coding with one or two subcarrier frequencies at 423 kHz and 484 kHz. Data are transferred from the ST25DVxxx at 6.6 Kbit/s in low data rate mode and 26 Kbit/s in high data rate mode. The ST25DVxxx supports the 53 Kbit/s in high data rate mode in one subcarrier frequency at 423 kHz.

The ST25DVxxx follows ISO/IEC 15693 or NFC Forum Type 5 recommendation for radio-frequency power and signal interface and for anticollision and transmission protocol.

RF communication

Access to a ISO/IEC 15693 device

The dialog between the “RF reader” and the ST25DVxxx takes place as follows:

•

These operations use the RF power transfer and communication signal interface described below (see Power transfer, Frequency and Operating field). This technique is called RTF (Reader talk first).

• activation of the ST25DVxxx by the RF operating field of the reader, transmission of a command by the reader (ST25DVxxx detects carrier amplitude modulation) transmission of a response by the ST25DVxxx(ST25DVxxx modulates is load clocked at subcarrier rate)

Operating field

The ST25DVxxx operates continuously between the minimum and maximum values of the electromagnetic field H

defined in Table 253. RF characteristics

. The Reader has to generate a field within these limits.

Power transfer

Power is transferred to the ST25DVxxx by radio frequency at 13.56 MHz via coupling antennas in the ST25DVxxx and the Reader. The RF operating field of the reader is transformed on the ST25DVxxx antenna to an AC voltage which is rectified, filtered and internally regulated. During communications, the amplitude modulation (ASK) on this received signal is demodulated by the ASK demodulator

Frequency

The ISO 15693 standard defines the carrier frequency (f

) of the operating field as 13.56 MHz ±7 kHz.

RF communication and energy harvesting

As the current consumption can affect the AC signal delivered by the antenna, RF communications with

ST25DVxxx are not guaranteed during voltage delivery on the energy harvesting analog output V_EH.

RF communication can disturb and possibly stop Energy Harvesting mode.

Fast transfer mode mailbox access in RF

Thanks to dedicated commands, the RF interface has the possibility to check Mailbox availability, and the

capability to access it directly to put or get a message from it (see Section 5.1 Fast transfer mode (FTM)

for specific features).

DS10925 - Rev 9 page 74/200

7.4

7.4.1

ST25DV04K ST25DV16K ST25DV64K

RF protocol description

•

Protocol description

The transmission protocol (or simply “the protocol”) defines the mechanism used to exchange instructions and data between the VCD (Vicinity Coupling Device) and the ST25DVxxx in both directions. It is based on the concept of “VCD talks first”.

This means that a ST25DVxxx does not start transmitting unless it has received and properly decoded an instruction sent by the VCD. The protocol is based on an exchange of:

• a request from the VCD to the ST25DVxxx, a response from the ST25DVxxx to the VCD.

Each request and each response are contained in a frame. The frame are delimited by a Start of Frame (SOF) and End of Frame (EOF).

The protocol is bit-oriented. The number of bits transmitted in a frame is a multiple of eight (8), that is an integer number of bytes.

A single-byte field is transmitted least significant bit (LSBit) first. A multiple-byte field is transmitted least significant byte (LSByte) first and each byte is transmitted least significant bit (LSBit) first.

Figure 32. ST25DVxxx protocol timing

VCD

Request frame

Response frame

Response

frame

ST25DVxxx

Timing t

1 t

2 t

1 t

7.4.2

•

ST25DVxxx states referring to RF protocol

•

The ST25DVxxx can be in one of four states:

• Power-off

Ready

Quiet

Selected

Transitions between these states are specified in

Figure 33. ST25DVxxx state transition diagram and

Table 92. ST25DVxxx response depending on Request_flags .

Power-off state

The ST25DVxxx is in the Power-off state when it does not receive enough energy from the VCD.

Ready state

The ST25DVxxx is in the Ready state when it receives enough energy from the VCD. When in the Ready state, the ST25DVxxx answers any request where the Select_flag is not set.

DS10925 - Rev 9 page 75/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF protocol description

Quiet state

When in the Quiet state, the ST25DVxxx answers any request with the Address_flag set, except for Inventory requests.

Selected state

•

In the Selected state, the ST25DVxxx answers any request in all modes (see Section 7.4.3 Modes ):

• Request in Select mode with the Select_flag set

Request in Addressed mode if the UID matches

Request in Non-Addressed mode as it is the mode for general requests

Flags

Table 92. ST25DVxxx response depending on Request_flags

Address_flag

Addressed

Non addressed

Selected

Select_flag

Non selected

ST25DVxxx in Ready or Selected state

(Devices in Quiet state do not answer)

ST25DVxxx in Selected state

ST25DVxxx in Ready, Quiet or Selected state (the device which matches the

UID)

Error (03h) or no response (command dependent)

Figure 33. ST25DVxxx state transition diagram

Power off

Out of RF field after t

RF_OFF

Quiet

Out of field after t

RF_OFF

In RF field

Inventory

Ready

Any other command where Select_Flag is not set

Reset to ready where

Select with (# UID)

Select (UID)

Stay quiet(UID)

is set or

Selected

Any other command where the

Address_Flag is set AND where the Inventory_Flag is not set

Out of RF field after t

Any other command

RF_OFF

The ST25DVxxx returns to the Power Off state if the tag is out of the RF field for at least t

RF_OFF

The intention of the state transition method is that only one ST25DVxxx should be in the Selected state at a time.

When the Select_flag is set to 1, the request shall NOT contain a unique ID.

When the address_flag is set to 0, the request shall NOT contain a unique ID.

page 76/200

7.4.3

7.4.4

7.4.5

ST25DV04K ST25DV16K ST25DV64K

RF protocol description

Modes

The term “mode” refers to the mechanism used in a request to specify the set of ST25DVxxx devices that shall execute the request.

Addressed mode

When the Address_flag is set to 1 (Addressed mode), the request contains the Unique ID (UID) of the addressed

ST25DVxxx.

Any ST25DVxxx that receives a request with the Address_flag set to 1 compares the received Unique ID to its own. If it matches, then the ST25DVxxx executes the request (if possible) and returns a response to the VCD as specified in the command description.

If the UID does not match, then it remains silent.

Non-addressed mode (general request)

When the Address_flag is cleared to 0 (Non-Addressed mode), the request does not contain a Unique ID.

Select mode

When the Select_flag is set to 1 (Select mode), the request does not contain a unique ID. The ST25DVxxx in the

Selected state that receives a request with the Select_flag set to 1 executes it and returns a response to the VCD as specified in the command description.

Only the ST25DVxxx in the Selected state answers a request where the Select_flag is set to 1.

The system design ensures that only one ST25DVxxx can be in the Select state at a time.

•

Request format

The request consists of:

• an SOF,

• flags, a command code, parameters and data, a CRC, an EOF.

SOF Request_flags

Table 93. General request format

Command code Parameters Data 2 byte CRC EOF

Request flags

In a request, the “flags” field specifies the actions to be performed by the ST25DVxxx and whether corresponding fields are present or not.

The flags field consists of eight bits. Bit 3 (Inventory_flag) of the request flag defines the contents of the four

MSBs (bits 5 to 8). When bit 3 is reset (0), bits 5 to 8 define the ST25DVxxx selection criteria. When bit 3 is set

(1), bits 5 to 8 define the ST25DVxxx Inventory parameters.

DS10925 - Rev 9 page 77/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF protocol description

Table 94. Definition of request flags 1 to 4

Bit 1

Bit 2

Bit 3

Bit No Flag

Subcarrier_flag

Data_rate_flag

Inventory_flag

The meaning of flags 5 to 8 is described in Table 95. Request flags 5 to 8 when inventory_flag, Bit 3 = 0

Level

Bit 4

Protocol_extension

_flag

1. Subcarrier_flag refers to the ST25DVxxx-to-VCD communication.

2. Data_rate_flag refers to the ST25DVxxx-to-VCD communication.

Description

A single subcarrier frequency is used by the ST25DVxxx

Two subcarriers are used by the ST25DVxxx

Low data rate is used

High data rate is used

The meaning of flags 5 to 8 is described in Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1

No Protocol format extension

Protocol format extension. Reserved for future use.

Table 95. Request flags 5 to 8 when inventory_flag, Bit 3 = 0

Bit 5

Bit 6

Bit 7

Bit 8

Bit nb

Select flag (1)

Address flag

Option flag

RFU

Flag

Level

Description

The request is executed by any ST25DVxxx according to the setting of Address_flag

The request is executed only by the ST25DVxxx in Selected state

The request is not addressed. UID field is not present. The request is executed by all ST25DVxxxs.

The request is addressed. UID field is present. The request is executed only by the ST25DVxxx whose UID matches the

UID specified in the request.

Option not activated.

Option activated.

1. If the Select_flag is set to 1, the Address_flag is set to 0 and the UID field is not present in the request.

Bit nb

Bit 5

Bit 6

Bit 7

Bit 8

Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1

Flag

AFI flag

Nb_slots flag

Option flag

RFU

Level

AFI field is not present

AFI field is present

16 slots

1 slot

Description

page 78/200

7.4.6

7.4.7

ST25DV04K ST25DV16K ST25DV64K

RF protocol description

•

Response format

The response consists of: an SOF flags parameters and data a CRC an EOF

SOF Response_flags

Table 97. General response format

Parameters Data 2 byte CRC

Response flags

In a response, the flags indicate how actions have been performed by the ST25DVxxx and whether corresponding fields are present or not. The response flags consist of eight bits.

EOF

Bit Nb

Bit 1

Bit 2

Bit 3

Bit 4

Bit 5

Bit 6

Bit 7

Bit 8

Flag

Error_flag

Table 98. Definitions of response flags 1 to 8

RFU

Extension flag

RFU

Level

Description

No error

Error detected. Error code is in the “Error” field.

No extension

DS10925 - Rev 9 page 79/200

7.4.8

7.5

ST25DV04K ST25DV16K ST25DV64K

Timing definition

Response and error code

If the Error_flag is set by the ST25DVxxx in the response, the Error code field is present and provides information about the error that occurred.

Error codes not specified in Table 99

are reserved for future use.

Error code

11h

12h

13h

14h

15h

01h

02h

03h

0Fh

10h

Table 99. Response error code definition

Meaning

Command is not supported.

Command is not recognized (format error).

The option is not supported.

Error with no information given.

The specified block is not available.

The specified block is already locked and thus cannot be locked again.

The specified block is locked and its contents cannot be changed.

The specified block was not successfully programmed.

The specified block was not successfully locked.

The specified block is protected in read.

Timing definition t

: ST25DVxxx response delay

Upon detection of the rising edge of the EOF received from the VCD, the ST25DVxxx waits for a t

1nom

time before transmitting its response to a VCD request or switching to the next slot during an inventory process. Values of t

are given in Table 100. Timing values

: VCD new request delay t

is the time after which the VCD may send an EOF to switch to the next slot when one or more ST25DVxxx responses have been received during an Inventory command. It starts from the reception of the EOF from the

ST25DVxxxs.

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for transmitting the VCD request to the ST25DVxxx.

is also the time after which the VCD may send a new request to the ST25DVxxx, as described in

Figure 32. ST25DVxxx protocol timing

Values of t

are given in

Table 100. Timing values .

: VCD new request delay when no response is received from the ST25DVxxx t

3 is the time after which the VCD may send an EOF to switch to the next slot when no ST25DVxxx response has been received.

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for transmitting the VCD request to the ST25DVxxx.

From the time the VCD has generated the rising edge of an EOF:

• If this EOF is 100% modulated, the VCD waits for a time at least equal to t sending a new EOF.

3min

for 100% modulation before

• If this EOF is 10% modulated, the VCD waits for a time at least equal to t

3min sending a new EOF.

for 10% modulation before

DS10925 - Rev 9 page 80/200

Note:

ST25DV04K ST25DV16K ST25DV64K

Timing definition

Table 100. Timing values

Minimum (min) values

100% modulation 10% modulation

Nominal (nom) values Maximum (max) values t

1 t

2 t

4320 / f c

= 318.6 µs

4192 / f c

= 309.2 µs t

1max

(2) + t

SOF

1max

+ t

NRT

(4)

+ t

2min

4352 / f c

= 320.9 µs

No t

No t nom nom

4384 / f c

= 323.3 µs

No t

No t max max

The ST25DVxxx supports the commands described in this section. Their codes are given in Table 101. Command codes .

1. VCD request will not be interpreted during the first milliseconds following the RF field rising.

2. t

1max

does not apply for write-alike requests. Timing conditions for write-alike requests are defined in the command description.

3. t

SOF

is the time taken by the ST25DVxxx to transmit an SOF to the VCD. t rate or Low data rate.

SOF

depends on the current data rate: High data

4. t

NRT

is the nominal response time of the ST25DVxxx. t

NRT

depends on V

ICC

to ST25DVxxx data rate and subcarrier modulation mode.

The tolerance of specific timings is ± 32/f

DS10925 - Rev 9 page 81/200

7.6

7.6.1

ST25DV04K ST25DV16K ST25DV64K

RF commands

•

RF command code list

The ST25DVxxx supports the following legacy and extended RF command set:

Inventory , used to perform the anticollision sequence.

Stay Quiet , used to put the ST25DVxxx in quiet mode, where it does not respond to any inventory command.

Select , used to select the ST25DVxxx. After this command, the ST25DVxxx processes all Read/Write commands with Select_flag set.

Reset To Ready , used to put the ST25DVxxx in the ready state.

Read Single Block and Extended Read Single Block , used to output the 32 bit of the selected block and its locking status.

Write Single Block and Extended Write Single Block , used to write and verify the new content for an update of a 32 bit block, provided that it is not in a locked memory area.

Read Multiple Blocks and Extended Read Multiple Block , used to read the selected blocks in an unique area, and send back their value.

Write Multiple Blocks and Extended Write Multiple Block , used to write and verify the new content for an update of up to 4 blocks located in the same memory area, which was not previously locked for writing.

Write AFI , used to write the 8-bit value in the AFI register.

Lock AFI , used to lock the AFI register.

Write DSFID , used to write the 8-bit value in the DSFID register.

Lock DSFID , used to lock the DSFID register.

Get System information and Extended Get System Information , used to provide the system information value.

Get System information , used to provide the standard system information values.

Extended Get System Information , used to provide the extended system information values.

Write Password , used to update the 64 bit of the selected areas or configuration password, but only after presenting the current one.

Lock Block and Extended Lock block , used to write the CC file blocks security status bits (Protect the CC

File content against writing).

Present Password , enables the user to present a password to open a security session.

Fast Read Single Block and Fast Extended Read Single Block, used to output the 32 bits of the selected block and its locking status at doubled data rate.

Fast Read Multiple Blocks and Fast Extended Read Multiple Blocks , used to read the selected blocks in a single area and send back their value at doubled data rate.

Read Message , used to output up to 256 byte of the Mailbox.

Read Message Length , used to output the Mailbox message length.

Fast Read Message , used to output up to 256 byte of the mailbox, at double data rate.

Write Message , used to write up to 256 byte in the Mailbox.

Fast Read Message Length , used to ouput the mailbox length, at double data rate.

Fast Write Message , used to write up to 256 bytes in the mailbox, with answer at double data rate.

Read Configuration , used to read static configuration registers.

Write Configuration , used to write static configuration registers.

Read Dynamic Configuration, used to read dynamic register.

Write Dynamic Configuration , used to write dynamic register.

Fast Read Dynamic Configuration , used to read dynamic register, at double data rate.

Fast Write Dynamic Configuration , used to write dynamic register, with answer at double data rate.

Manage GPO , used to drive GPO output value when corresponding GPO mode is enabled.

DS10925 - Rev 9 page 82/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.2

Command codes list

Table 101. Command codes

29h

30h

31h

32h

33h

22h

23h

24h

25h

26h

27h

28h

34h

2Ah

2Bh

2Ch

3Bh

3Ch

Command code standard

01h

02h

20h

21h

Write Multiple Blocks

Function

Extended Read Single Block

Extended Write Single Block

Extended Lock block

Extended Read Multiple Blocks

Extended Write Multiple Blocks

Lock DSFID

Get System Info

Get Multiple Block Security Status

Extended Get System Info

Extended Get Multiple Block Security Status

CCh

CDh

CEh

C3h

C4h

C5h

CAh

CBh

ABh

ACh

ADh

AEh

B1h

B3h

C0h

Command code custom

A0h

A1h

A9h

AAh

Function

Read Dynamic Configuration

Write Dynamic Configuration

Write Password

Present Password

Fast Read Single Block

Fast Read Multiple Blocks

Fast Extended Read Single Block

Fast Extended Read Multiple Block

Fast Write Message

Fast Read Message Length

Fast Read Message

Fast Read Dynamic configuration

Fast Write Dynamic Configuration

7.6.3

General command rules

In case of a valid command, the following paragraphs will describe the expected behavior for each command.

But in case of an invalid command, in a general manner, the ST25DVxxx will behave as follows:

•

if flag usage is incorrect, the error code 03h will be issued only if the right UID is used in the command, otherwise no response will be issued.

error 02h will be issued if the custom command is used with the manufacturer code different from the ST one

Another case is if I 2 C is busy. In this case, any RF command (except Inventory, Select, Stay quiet and Reset to ready) will get 0Fh error code as response only: if select flag and address flags are not set at the same time (except if ST25DVxxx is in quiet state) if select flag is set and ST25DVxxx is in selected state.

For all other commands, if I 2 C is busy, no response will be issued by ST25DVxxx.

DS10925 - Rev 9 page 83/200

7.6.4

Note:

7.6.5

ST25DV04K ST25DV16K ST25DV64K

RF commands

•

Inventory

•

Upon receiving the Inventory request, the ST25DVxxx runs the anticollision sequence. The Inventory_flag is set to

1. The meaning of flags 5 to 8 is shown in

Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1 .

The request contains:

• the flags the Inventory command code (001) the AFI if the AFI flag is set the mask length the mask value if mask length is different from 0 the CRC

The ST25DVxxx does not generate any answer in case of error.

Request

SOF

Request_flags

8 bits

The response contains:

• the flags

• the Unique ID

Table 102. Inventory request format

Inventory Optional AFI Mask length Mask value

01h 8 bits 8 bits 0 - 64 bits

CRC16

16 bits

Request

EOF

Response SOF

Table 103. Inventory response format

8 bits

Response_flags DSFID

8 bits

UID

64 bits

CRC16

16 bits

Response EOF

During an Inventory process, if the VCD does not receive an RF ST25DVxxx response, it waits for a time t

before sending an EOF to switch to the next slot. t

starts from the rising edge of the request EOF sent by the VCD.

•

If the VCD sends a 100% modulated EOF, the minimum value of t

is: t

3 min = 4384/f

(323.3µs) + t

SOF

If the VCD sends a 10% modulated EOF, the minimum value of t

is: t

3 min = 4384/f

(323.3µs) + t

NRT

+ t

2min where:

• t

SOF

is the time required by the ST25DVxxx to transmit an SOF to the VCD,

• t

NRT

is the nominal response time of the ST25DVxxx.

NRT

and t

SOF

are dependent on the ST25DVxxx-to-VCD data rate and subcarrier modulation mode.

In case of error, no response is sent by ST25DVxxx.

Stay Quiet

On receiving the Stay Quiet command, the ST25DVxxx enters the Quiet state if no error occurs, and does NOT send back a response. There is NO response to the Stay Quiet command even if an error occurs.

•

The Option_flag is not supported. The Inventory_flag must be set to 0.

When in the Quiet state: the ST25DVxxx does not process any request if the Inventory_flag is set, the ST25DVxxx processes any Addressed request.

DS10925 - Rev 9 page 84/200

7.6.6

ST25DV04K ST25DV16K ST25DV64K

RF commands

The ST25DVxxx exits the Quiet state when:

•

• it is reset (power off), receiving a Select request. It then goes to the Selected state, receiving a Reset to Ready request. It then goes to the Ready state.

Request SOF

Table 104. Stay Quiet request format

8 bits

Request flags

02h

Stay Quiet UID

64 bits

CRC16

16 bits

Request EOF

The Stay Quiet command must always be executed in Addressed mode (Select_flag is reset to 0 and

Address_flag is set to 1).

Figure 34. Stay Quiet frame exchange between VCD and ST25DVxxx

VCD

SOF

Stay Quiet request

EOF

ST25DVxxx

Read Single Block

On receiving the Read Single Block command, the ST25DVxxx reads the requested block and sends back its

32-bit value in the response. The Option_flag is supported, when set response include the Block Security Status.

The Inventory_flag must be set to 0.

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Request SOF Request_flags

8 bits

1. This the field is optional.

Table 105. Read Single Block request format

Read Single Block

20h

UID

(1)

Block number

64 bits 8 bits

•

Request parameters:

• Request flags

UID (optional)

Block number

CRC16

16 bits -

Request EOF

Table 106. Read Single Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

Response_flags

8 bits

Block security status

(1)

8 bits

Data

32 bits

CRC16

16 bits -

Response EOF

Response parameters:

•

Table 107. Block security status

Four bytes of block data

)

DS10925 - Rev 9 page 85/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7 b

Reserved for future use.

All at 0.

5 b

Table 107. Block security status b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Response SOF

Table 108. Read Single Block response format when Error_flag is set

8 bits

Response_flags

8 bits

Error code CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 03h: command option not supported

– 0Fh: error with no information

– 10h: the specified block is not available

– 15h: the specified block is read-protected

Figure 35. Read Single Block frame exchange between VCD and ST25DVxxx

VCD SOF

Read Single Block request

EOF

ST25DVxxx t

SOF

Read Single Block response

EOF

7.6.7

Extended Read Single Block

On receiving the Extended Read Single Block command, the ST25DVxxx reads the requested block and sends back its 32-bit value in the response.

When the Option_flag is set, the response includes the Block Security Status.

Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and

ST25DV64K-xx can be addressed using this command.

Table 109. Extended Read Single Block request format

Request SOF Request_flags

8 bits

1. This field is optional.

Extended Read Single Block

30h

UID

(1)

Block number CRC16 Request EOF

64 bits 16 bits 16 bits -

•

Request parameters:

• Request flags

UID (optional)

Block number (from LSB byte to MSB byte)

DS10925 - Rev 9 page 86/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 110. Extended Read Single Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

Response_flags

8 bits

Block security status

(1)

8 bits

Data

32 bits

CRC16

16 bits -

Response EOF

Response parameters:

•

Table 107. Block security status

Four bytes of block data

) b

7 b

6 b

Reserved for future use.

All at 0.

Table 111. Block security status b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Table 112. Extended Read Single Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 03h: command option not supported or no response

– 0Fh: error with no information

– 10h: the specified block is not available

– 15h: the specified block is read-protected

Figure 36. Extended Read Single Block frame exchange between VCD and ST25DVxxx

VCD SOF

Extended Read

Single Block request

EOF

ST25DVxxx t

SOF

Extended Read

Single Block response

EOF

7.6.8

Write Single Block

On receiving the Write Single Block command, the ST25DVxxx writes the data contained in the request to the targeted block and reports whether the write operation was successful in the response. When the Option_flag is set, wait for EOF to respond. The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

DS10925 - Rev 9 page 87/200

Note:

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 113. Write Single Block request format

Request SOF Request_flags

8 bits

1. This field is optional.

Write Single Block UID

(1)

21h

Block number

64 bits 8 bits

Data

32 bits

CRC16

16 bits -

Request EOF

Request parameters:

•

Request flags

UID (optional)

Block number

Data

Table 114. Write Single Block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the writing cycle.

Response SOF

Table 115. Write Single Block response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 12h: the specified block is locked or protected and its contents cannot be changed

– 13h: the specified block was not successfully programmed

For more details, see Figure 7. Memory organization

Figure 37. Write Single Block frame exchange between VCD and ST25DVxxx

VCD SOF

Write Single

Block request

EOF

ST25DVxxx t

SOF

Write Single

Block response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Write Single

Block response

EOF

DS10925 - Rev 9 page 88/200

7.6.9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Extended Write Single Block

On receiving the Extended Write Single command, the ST25DVxxx writes the data contained in the request to the targeted block and reports whether the write operation was successful in the response. When the Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Table 116. Extended Write Single request format

Request SOF Request_flags Extended Write Single Block UID (1)

8 bits 31h

Block number

64 bits 16 bits

Data CRC16 Request EOF

32 bits 16 bits -

1. This field is optional.

Request parameters:

•

Request flags

UID (optional)

Block number (from LSB byte to MSB byte)

Data (from LSB byte to MSB byte)

Table 117. Extended Write Single response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the writing cycle.

Table 118. Extended Write Single response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 12h: the specified block is locked and its contents cannot be changed

– 13h: the specified block was not successfully programmed

DS10925 - Rev 9 page 89/200

VCD

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 38. Extended Write Single frame exchange between VCD and ST25DVxxx

SOF

Extended Write

Single request

EOF

ST25DVxxx t

SOF

Extended Write

Single response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Extended Write

Single response

EOF

7.6.10

Lock Block

On receiving the Lock block request, the ST25DVxxx locks the single block value permanently and protects its content against new writing.

This command is only applicable for the blocks 0 and 1 which may include a CC file.

For a global protection of a area, update accordingly the RFA i

SS bits in the system area. The Option_flag is supported, when set wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not lock correctly the single block value in memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Request SOF Request_flags

8 bits

1. This field is optional.

Table 119. Lock block request format

22h

Lock block

64 bits

UID (1)

block number

8 bits

CR7C16

16 bits -

Request EOF

•

Request parameter:

• Request Flags

UID (optional)

Only block numbers 0 and 1 are allowed to protect the CCFile in case of NDEF (from LSB byte to MSB byte)

Table 120. Lock block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

Response SOF

Table 121. Lock block response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 90/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response parameter:

• Error code as Error_flag is set

– 03h: command option not supported

– 10h: block not available

– 11h: the specified block is already locked and thus cannot be locked again

– 14h: the specified block was not successfully locked

Figure 39. Lock Block frame exchange between VCD and ST25DVxxx

VCD SOF

Lock Block request

EOF

ST25DVxxx t

SOF

Lock Block response

EOF

Lock sequence when error

ST25DVxxx W t

SOF

Lock Block response

EOF

7.6.11

Extended Lock block

On receiving the extended Lock block request, the ST25DVxxx locks the single block value permanently and protects its content against new writing.

This command is only applicable for the blocks 0 and 1 which may include a CC file.

For a global protection of a area, update accordingly the AiSS bits in the system area. When the Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not lock correctly the single block value in memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Request SOF Request_flags

8 bits

1. The field is optional.

Table 122. Extended Lock block request format

Extended Lock block

32h

UID

(1)

block number

64 bits 16 bits

CRC16

16 bits -

Request EOF

•

Request parameter:

• Request Flags

UID (optional)

Only block numbers 0 and 1 are allowed to protect the CCFile in case of NDEF (from LSB byte to MSB byte)

Table 123. Extended Lock block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

DS10925 - Rev 9 page 91/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

• No parameter

Table 124. Extended Lock block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 03h: command option not supported

– 10h: block not available

– 11h: the specified block is already locked and thus cannot be locked again

– 14h: the specified block was not successfully locked

Figure 40. Extended Lock block frame exchange between VCD and ST25DVxxx

VCD SOF

Extended

Lock block request

EOF

ST25DVxxx t

SOF

Extended

Lock block response

EOF

Lock sequence when error

ST25DVxxx W t

SOF

Extended

Lock block response

EOF

7.6.12

Read Multiple Blocks

When receiving the Read Multiple Block command, the ST25DVxxx reads the selected blocks and sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h to FFh in the request and the value is minus one (–1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed at 256 assuming that they are all located in the same area. If the number of blocks overlaps areas or overlaps the end of user memory, the ST25DVxxx returns an error code. When the Option_flag is set, the response returns the Block Security Status.

The Inventory_flag must be set to 0.

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Table 125. Read Multiple Block request format

Request SOF Request_flags

8 bits

1. The field is optional.

Read Multiple

Block

23h

UID

(1)

First block number

64 bits 8 bits

Number of blocks CRC16 Request EOF

8 bits 16 bits -

Request parameters:

• Request flags

• UID (optional)

• First block number

DS10925 - Rev 9 page 92/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

• Number of blocks

Table 126. Read Multiple Block response format when Error_flag is NOT set

Response SOF

Response_ flags

8 bits -

1. The field is optional.

2. Repeated as needed.

Block security

status (1)

8 bits (2)

Data

32 bits (2)

16 bits

CRC16

Response EOF

Response parameters:

•

Table 127. Block security status

N blocks of data

) b

7 b

6 b

Reserved for future use.

All at 0.

Table 127. Block security status b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Table 128. Read Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: command option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 15h: the specified block is read-protected

Figure 41. Read Multiple Block frame exchange between VCD and ST25DVxxx

VCD SOF

Read Multiple

Block request

EOF

ST25DVxxx t

SOF

Read Multiple

Block response

EOF page 93/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.13

Extended Read Multiple Blocks

When receiving the Extended Read multiple block command, the ST25DVxxx reads the selected blocks and sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h to last block of memory in the request and the value is minus one (-1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed at 2047 assuming that they are all located in the same area. If the number of blocks overlaps areas or overlaps the end of user memory, the ST25DVxxx returns an error code. When the Option_flag is set, the response returns the Block

Security Status.

The Inventory_flag must be set to 0.

Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Request

SOF

8 bits

1. This field is optional.

Table 129. Extended Read Multiple Block request format

Request_flags

Extended

Read

Multiple

Block

33h

UID (1)

64 bits

First block number

16 bits

Number of blocks

16 bits

CRC16

16 bits

•

Request parameters:

• Request flags

•

UID (optional)

First block number (from LSB byte to MSB byte)

Number of blocks (from LSB byte to MSB byte)

Request

EOF

Table 130. Extended Read Multiple Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

2. Repeated as needed.

Response_ flags

8 bits

Block security

status (1)

8 bits

Data

32 bits

Block security status if Option_flag is set (see Table 131. Block security status

CRC16

16 bits

Response EOF

Response parameters:

•

)

• N blocks of data b

7 b

6 b

Reserved for future use.

All at 0 b

Table 131. Block security status b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Table 132. Extended Read Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

DS10925 - Rev 9 page 94/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

• Error code as Error_flag is set:

– 03h: command option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 15h: the specified block is read-protected

Figure 42. Extended Read Multiple Block frame exchange between VCD and ST25DVxxx

VCD SOF

Extended

Read Multiple

Block request

EOF

ST25DVxxx t

SOF

Extended

Read Multiple

Block response

EOF

7.6.14

Write Multiple Blocks

On receiving the Write Multiple Block command, the ST25DVxxx writes the data contained in the request to the requested blocks, and reports whether the write operation were successful in the response. ST25DVxxx supports up to 4 blocks, data field must be coherent with the number of blocks to program.

If some blocks overlaps areas, or overlap end of user memory, the ST25DVxxx returns an error code and none of the blocks are programmed. When the Option_flag is set, wait for EOF to respond. During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the memory. The W t

time is equal to t

1nom

+ m × 302 μs < 20 ms. (m is an integer, it is function of Nb number of blocks to be programmed).

The Inventory_flag must be set to 0.

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Request

SOF

Request_flags

8 bits

Table 133. Write Multiple Block request format

Write

Multiple

Block

UID (1)

First Block number

Number of

block (2)

24h 64 bits 8 bits 8 bits

Data

Block length

1. This field is optional.

2. The number of blocks in the request is one less than the number of blocks that the VICC shall write.

3. Repeated as needed

Request parameters:

•

Request flags

UID (optional)

First Block number

Number of blocks

Data

CRC16

16 bits

Request

EOF

DS10925 - Rev 9 page 95/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 134. Write Multiple Block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the writing cycle.

Table 135. Write Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: command option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 12h: the specified block is locked and its contents cannot be changed

– 13h: the specified block was not successfully programmed

Figure 43. Write Multiple Block frame exchange between VCD and ST25DVxxx

VCD SOF

Write Multiple block request

EOF

ST25DVxxx t

SOF

Write Multiple block response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Write Multiple block response

EOF

7.6.15

Extended Write Multiple Blocks

On receiving the Extended Write multiple block command, the ST25DVxxx writes the data contained in the request to the targeted blocks and reports whether the write operation were successful in the response.

ST25DVxxx supports up to 4 blocks, data field must be coherent with number of blocks to program.

If some blocks overlaps areas, or overlap end of user memory the ST25DVxxx returns an error code and none of the blocks are programmed.

When the Option_flag is set, wait for EOF to respond. During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the memory. The W t

time is equal to t

1nom

+ m × 302 μs < 20 ms (m is an integer function of Nb number of blocks to be programmed).

The inventory_flag must be set to 0.

Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and

ST25DV64K-xx can be addressed using this command.

DS10925 - Rev 9 page 96/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 136. Extended Write Multiple Block request format

Request

SOF

Request_flags

Extended

Write multiple block

UID (1)

First Block number

Number of

block (2)

Data

8 bits 34h 64 bits 16 bits 16 bits

Block length

1. This field is optional.

2. The number of blocks in the request is one less than the number of blocks that the VICC shall write.

3. Repeated as needed

CRC16

16 bits -

Request

EOF

•

Request parameters:

• Request flags

UID (optional)

First block number (from LSB byte to MSB byte)

Number of block (from LSB byte to MSB byte)

Data (from first to last blocks, from LSB bytes to MSB bytes)

Table 137. Extended Write Multiple Block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the writing cycle.

Table 138. Extended Write Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: command option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 12h: the specified block is locked and its contents cannot be changed

– 13h: the specified block was not successfully programmed page 97/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

VCD

Figure 44. Extended Write Multiple Block frame exchange between VCD and ST25DVxxx

SOF

Extended Write

Multiple Block request

EOF

ST25DVxxx t

SOF

Extended Write

Multiple Block response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Extended Write

Multiple Block response

EOF

7.6.16

Select

When receiving the Select command:

• If the UID is equal to its own UID, the ST25DVxxx enters or stays in the Selected state and sends a response.

• If the UID does not match its own UID, the selected ST25DVxxx returns to the Ready state and does not send a response.

The ST25DVxxx answers an error code only if the UID is equal to its own UID. If not, no response is generated. If an error occurs, the ST25DVxxx remains in its current state.

The Option_flag is not supported, and the Inventory_flag must be set to 0.

Request SOF

Request parameter:

• UID

Table 139. Select request format

8 bits

Request_flags

25h

Select UID

64 bits

CRC16

16 bits -

Request EOF

Table 140. Select Block response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

Response SOF

Table 141. Select response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response parameter:

• Error code as Error_flag is set:

– 03h: the option is not supported

– 0Fh: error with no information given

Response EOF

DS10925 - Rev 9 page 98/200

VCD

ST25DVxxx

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 45. Select frame exchange between VCD and ST25DVxxx

SOF Select request EOF t

SOF Select response EOF

DS10925 - Rev 9 page 99/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.17

Reset to Ready

On receiving a Reset to Ready command, the ST25DVxxx returns to the Ready state if no error occurs. In the

Addressed mode, the ST25DVxxx answers an error code only if the UID is equal to its own UID. If not, no response is generated.

The Option_flag is not supported, and the Inventory_flag must be set to 0.

Table 142. Reset to Ready request format

Request SOF

1. This field is optional.

Request_flags

8 bits 26h

Reset to Ready UID

(1)

64 bits

CRC16

16 bits

Request parameter:

• UID (optional)

Request EOF

Table 143. Reset to Ready response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

Response SOF

Table 144. Reset to ready response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: the option is not supported

– 0Fh: error with no information given

Figure 46. Reset to Ready frame exchange between VCD and ST25DVxxx

VCD SOF

Reset to Ready request

EOF

ST25DVxxx t

SOF

Reset to Ready response

EOF

DS10925 - Rev 9 page 100/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.18

Write AFI

On receiving the Write AFI request, the ST25DVxxx programs the 8-bit AFI value to its memory. When the

Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not write correctly the AFI value into the memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Table 145. Write AFI request format

Request SOF Request_flags

8 bits

1. This field is optional.

27h

Write AFI UID

(1)

64 bits 8 bits

AFI

Request parameter:

• Request flags

• UID (optional)

• AFI

CRC16

16 bits -

Request EOF

Response SOF

Table 146. Write AFI response format when Error_flag is NOT set

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

Response SOF

Table 147. Write AFI response format when Error_flag is set

8 bits

Response_ flags

8 bits

Error code CRC16

16 bits -

Response parameter:

• Error code as Error_flag is set

– 03h: command option is not supported

– 0Fh: error with no information given

– 12h: the specified block is locked and its contents cannot be changed

– 13h: the specified block was not successfully programmed

Response EOF

DS10925 - Rev 9 page 101/200

VCD

ST25DVxxx

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 47. Write AFI frame exchange between VCD and ST25DVxxx

SOF

Write AFI request

EOF t

SOF

Write AFI response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Write AFI response

EOF

7.6.19

Lock AFI

On receiving the Lock AFI request, the ST25DVxxx locks the AFI value permanently. When the Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not lock correctly the AFI value in memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Table 148. Lock AFI request format

Request SOF

1. This field is optional.

8 bits

Request_flags

28h

Lock AFI

UID (1)

64 bits

CRC16

16 bits

Request parameter:

• Request Flags

• UID (optional)

Request EOF

Response SOF

Table 149. Lock AFI response format when Error_flag is NOT set

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

Response SOF

Response parameter:

Table 150. Lock AFI response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 102/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

• Error code as Error_flag is set

– 03h: command option is not supported

– 0Fh: error with no information given

– 11h: the specified block is already locked and thus cannot be locked again

– 14h: the specified block was not successfully locked

Figure 48. Lock AFI frame exchange between VCD and ST25DVxxx

VCD SOF

Lock AFI request

EOF

ST25DVxxx t

SOF

Lock AFI response

EOF

Lock sequence when error

ST25DVxxx W t

SOF

Lock AFI response

EOF

7.6.20

Write DSFID

On receiving the Write DSFID request, the ST25DVxxx programs the 8-bit DSFID value to its memory. When the

Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not write correctly the DSFID value in memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Request SOF

1. This field is optional.

Request_flags

8 bits

Table 151. Write DSFID request format

29h

Write DSFID UID

(1)

64 bits

DSFID

8 bits

•

Request parameter:

• Request flags

UID (optional)

DSFID

CRC16

16 bits -

Request EOF

Table 152. Write DSFID response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter

DS10925 - Rev 9 page 103/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response SOF

Table 153. Write DSFID response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 03h: command option is not supported

– 0Fh: error with no information given

– 12h: the specified block is locked and its contents cannot be changed

– 13h: the specified block was not successfully programmed

Figure 49. Write DSFID frame exchange between VCD and ST25DVxxx

VCD SOF

Write DSFID request

EOF

ST25DVxxx t

SOF

Write DSFID response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Write DSFID response

EOF

7.6.21

Lock DSFID

On receiving the Lock DSFID request, the ST25DVxxx locks the DSFID value permanently. When the Option_flag is set, wait for EOF to respond.

The Inventory_flag must be set to 0.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not lock correctly the DSFID value in memory. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Table 154. Lock DSFID request format

Request SOF

1. This field is optional.

8 bits

Request_flags

2Ah

Lock DSFID

UID (1)

64 bits

CRC16

16 bits

Request parameter:

• Request flags

• UID (optional)

Request EOF

Table 155. Lock DSFID response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 104/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response parameter:

• No parameter.

Response SOF

Table 156. Lock DSFID response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: command option is not supported

– 0Fh: error with no information given

– 11h: the specified block is already locked and thus cannot be locked again

– 14h: the specified block was not successfully locked

Figure 50. Lock DSFID frame exchange between VCD and ST25DVxxx

VCD SOF

Lock DSFID request

EOF

ST25DVxxx t

SOF

Lock DSFID response

EOF

Lock sequence when error

ST25DVxxx W t

SOF

Lock DSFID response

EOF page 105/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.22

Get System Info

When receiving the Get System Info command, the ST25DVxxx sends back its information data in the response.

The Option_flag is not supported. The Inventory_flag must be set to 0. The Get System Info can be issued in both

Addressed and Non Addressed modes.

Request SOF

1. This field is optional.

Request_flags

8 bits

Table 157. Get System Info request format

Get System Info

2Bh 64 bits

UID

(1)

16 bits

CRC16

Request parameter:

• Request flags

• UID (optional)

Request EOF

Table 158. Get System Info response format Error_flag is NOT set

Device

ST25DV64K-xx

ST25DV16K-xx -

ST25DV04K-xx

Response SOF Response flags Information flags UID DSFID AFI Mem. Size IC ref. CRC16 Response EOF

00h

0Bh

0Fh

64 bits

8 bits

NA (1)

037Fh

26h

24h

16 bits

1. Field not present in this configuration

•

Response parameters:

• Information flags set to 0Bh/0Fh. DSFID, AFI and IC reference fields are present.

UID code on 64 bits

DSFID value

AFI value

MemSize: Block size in bytes and memory size in number of blocks (only present for ST25DV04K-xx configurations)

Table 159. Memory size

•

MSB

RFU

14 13

Block size in byte

03h

ST25DVxxx IC reference: the 8 bits are significant.

9 8

Number of blocks

7Fh

Response SOF

Table 160. Get System Info response format when Error_flag is set

01h

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: Option not supported

– 0Fh: error with no information given

LSB

DS10925 - Rev 9 page 106/200

VCD

ST25DVxxx

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 51. Get System Info frame exchange between VCD and ST25DVxxx

SOF

Get System info request

EOF t

SOF

Get System info response

EOF

7.6.23

Extended Get System Info

When receiving the Extended Get System Info command, the ST25DVxxx sends back its information data in the response.

The Option_flag is not supported. The Inventory_flag must be set to 0. The Extended Get System Info can be issued in both Addressed and Non Addressed modes.

b1 b2 b3 b4 b5 b6

•

Table 161. Extended Get System Info request format

Request SOF Request_flags Extended Get System Info Parameter request field

UID (1)

CRC16 Request EOF

8 bits 0xx1xxxxb 8 bits 64 bits 16 bits -

1. This field is optional.

Request flags

Request parameters

UID (optional) b7 b8

Bit

DSFID

AFI

Flag name

VICC memory size

IC reference

MOI

VICC Command list

CSI Information

Extended Get System

Info parameter Field

Table 162. Parameter request list

Value Description

No request of DSFID

Request of DSFID

No request of AFI

Request of AFI

No request of data field on VICC memory size

Request of data field on VICC memory size

No request of Information on IC reference

Request of Information on IC reference

Information on MOI always returned in response flag

No request of Data field of all supported commands

Request of Data field of all supported commands

No request of CSI list

Request of CSI list

One byte length of Extended Get System

Info parameter field

DS10925 - Rev 9 page 107/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

MSB

RFU

Table 163. Extended Get System Info response format when Error_flag is NOT set

Response

SOF

Response_flags

00h

Information flags

8 bits

Table 164. Response Information Flag .

UID

1. See

2. This field is optional.

3. Number of bytes is function of parameter list selected.

DSFID

64 bits 8 bits

(1) (2) AFI (2) (1)

Other Field

(2) (1)

8 bits

up to 64 bits (3)

CRC16

16 bits -

Response

EOF

Response parameters:

•

Information flag defining which fields are present

UID code on 64 bits

DSFID value (if requested in Parameters request field)

AFI value (if requested in Parameters request field)

Other fields:

– VICC Memory size (if requested in Parameters request field)

– ICRef(if requested in Parameters request field)

– VICC Command list (if requested in Parameters request field)

Bit b1 b2 b3 b4 b5 b6 b7 b8

Meaning if bit is set

DSFID

AFI

VICC memory size

IC reference

MOI

VICC Command list

CSI Information

Info flag filed

Table 164. Response Information Flag

Comment

DSFID field is not present

DSFID field is present

AFI field is not present

AFI field is present

Data field on VICC memory size is not present.

Data field on VICC memory size is present.

Information on IC reference field is not present.

Information on IC reference field is present

1 byte addressing

2 byte addressing

Data field of all supported commands is not present

Data field of all supported commands is present

CSI list is not present

One byte length of Info flag field

Table 165. Response other field: ST25DVxxx VICC memory size

22 21

03h

Block size in byte

17 16

Number of blocks

07FFh (ST25DV64K-xx)

01FFh (ST25DV16K-xx)

007Fh (ST25DV04K-xx)

LSB

01 page 108/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 166. Response other field: ST25DVxxx IC Ref

1 byte

ICRef

24h (ST25DV04K-xx) or 26h (ST25DV16K-xx and ST25DV64K-xx)

Table 167. Response other field: ST25DVxxx VICC command list

MSB

00h

Byte 4

25 24

3Fh

Byte3

17 16

3Fh

Byte 2

09 08

FFh

Byte 1 b1 b2 b3 b4 b5 b6 b7 b8

Bit

Table 168. Response other field: ST25DVxxx VICC command list Byte 1

Meaning if bit is set

Read single block is supported

Write single block is supported

Lock single block is supported

Read multiple block is supported

Write multiple block is supported

Select is supported

Reset to Ready is supported

Get multiple block security status is supported

Comment

including Select state b1 b2 b3 b4 b5 b6 b7 b8

Bit

Table 169. Response other field: ST25DVxxx VICC command list Byte 2

Meaning if bit is set

Write AFI is supported

Lock AFI is supported

Write DSFID is supported

Lock DSFID is supported

Get System Information is supported

Custom commands are supported

RFU

Comment

0 shall be returned

LSB

01 page 109/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands b4 b5 b6 b7 b8

Bit b1 b2 b3

Table 170. Response other field: ST25DVxxx VICC command list Byte 3

Meaning if bit is set

Extended read single block is supported

Extended write single block is supported

Extended lock single block is supported

Extended read multiple block is supported

Extended write multiple block is supported

Extended Get Multiple Security Status is supported

RFU

Comment

0 shall be returned

Table 171. Response other field: ST25DVxxx VICC command list Byte 4

Bit Meaning if bit is set b1 Read Buffer is supported b2 Select Secure State is supported b3 Final Response always includes crypto result b4 AuthComm crypto format is supported b5 SecureComm crypto format is supported b6 KeyUpdate is supported b7 Challenge is supported b8 If set to 1 a further Byte is transmitted

Comment

Means Response Buffer is supported

Means VCD or Mutual authentication are supported

Means that flag b3 will be set in the Final response

0 shall be returned

Table 172. Extended Get System Info response format when Error_flag is set

Response SOF

01h

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: Option not supported

– 0Fh: error with no information given

Figure 52. Extended Get System Info frame exchange between VCD and ST25DVxxx

VCD SOF

Extended Get

System Info request

EOF

ST25DVxxx t

SOF

Extended Get

System Info response

EOF page 110/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.24

Get Multiple Block Security Status

When receiving the Get Multiple Block Security Status command, the ST25DVxxx sends back its security status for each address block: 0 when block is writable else 1 when block is locked for writing. The blocks security status are defined by the area security status (and by LCK_CCFILE register for blocks 0 and 1). The blocks are numbered from 00h up to the maximum memory block number in the request, and the value is minus one (–1) in the field. For example, a value of “06” in the “Number of blocks” field requests will return the security status of seven blocks. This command does not respond an error if number of blocks overlap areas or overlap the end of the user memory.

The number of blocks is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 173. Get Multiple Block Security Status request format

Request SOF Request_flags

Get Multiple Block

Security Status

8 bits

1. This field is optional.

2Ch

UID (1)

First block number

64 bits 8 bits

Number of blocks

8 bits

CRC16 Request EOF

16 bits -

•

Request parameter:

• Request flags

•

UID (optional)

First block number

Number of blocks

Table 174. Get Multiple Block Security Status response format when Error_flag is NOT set

Response SOF

1. Repeated as needed.

Response_flags

8 bits

Block security status

8 bits

CRC16

16 bits -

Response EOF

Response parameters:

• Block security status b

7 b

Reserved for future use

All at 0 b

5 b

Table 175. Block security status b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Table 176. Get Multiple Block Security Status response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: the option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

DS10925 - Rev 9 page 111/200

VCD

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 53. Get Multiple Block Security Status frame exchange between VCD and ST25DVxxx

SOF

Get Multiple Block

Security request status

EOF

ST25DVxxx t

SOF

Get Multiple Block

Security response status

EOF

7.6.25

Extended Get Multiple Block Security Status

When receiving the Extended Get Multiple Block Security Status command, the ST25DVxxx sends back the security status for each address block: 0 when the block is writable else 1 when block is locked for writing. The block security statuses are defined by the area security status. The blocks are numbered from 00h up to the maximum memory block number in the request, and the value is minus one (–1) in the field. For example, a value of '06' in the “Number of blocks” field requests to return the security status of seven blocks.

This command does not respond an error if number of blocks overlap areas or overlap the end of the user memory.

The number of blocks is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Request

SOF

Table 177. Extended Get Multiple Block Security Status request format

Request_flags

8 bits

1. This field is optional.

Extended

Get Multiple

Block

Security

Status

3Ch

UID (1)

64 bits

First block number

16 bits

Number of blocks

16 bits

CRC16

16 bits

•

Request parameter:

• Request flags

UID (optional)

First block number (from LSB byte to MSB byte)

• Number of blocks (from LSB byte to MSB byte)

Request

EOF

Table 178. Extended Get Multiple Block Security Status response format when Error_flags NOT set

Response SOF

1. Repeated as needed.

Response_flags

8 bits

Block security status

8 bits

Please refer to Table 11. System configuration memory map for details on register addresses.

CRC16

16 bits -

Response EOF

Response parameters:

• Block security status

DS10925 - Rev 9 page 112/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands b

7 b

Table 179. Block security status b

5 b

Reserved for future use

All at 0 b

3 b

2 b

1 b

0: Current block not locked

1: Current block locked

Table 180. Extended Get Multiple Block Security Status response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 03h: the option is not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

Figure 54. Extended Get Multiple Block Security Status frame exchange between VCD and ST25DVxxx

VCD SOF

Extended Get

Multiple Block

Security request status

EOF

ST25DVxxx t

SOF

Extended Get

Multiple Block

Security response status

EOF page 113/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.26

Note:

Read Configuration

On receiving the Read Configuration command, the ST25DVxxx reads the static system configuration register at the Pointer address and sends back its 8-bit value in the response.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Request SOF Request_flags

8 bits

1. This field is optional.

Table 181. Read Configuration request format

Read Configuration

A0h

IC Mfg code

02h

UID (1)

Pointer CRC16 Request EOF

64 bits 8 bits 16 bits -

•

Request parameters:

System configuration register pointer

UID (optional)

Table 182. Read Configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags

8 bits

Register value CRC16

16 bits -

Response EOF

Response parameters:

• One byte of data: system configuration register

Table 183. Read Configuration response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set

– 02h: command not recognized

– 03h: the option is not supported

– 10h: block not available

– 0Fh: error with no information given

Figure 55. Read Configuration frame exchange between VCD and ST25DVxxx

VCD SOF

Read

Configuration request

EOF

ST25DVxxx t

SOF

Read

Configuration response

EOF

DS10925 - Rev 9 page 114/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.27

Note:

Write Configuration

The Write Configuration command is used to write static system configuration register. The Write Configuration must be preceded by a valid presentation of the RF configuration password (00) to open the RF configuration security session.

On receiving the Write Configuration command, the ST25DVxxx writes the data contained in the request to the system configuration register at the Pointer address and reports whether the write operation was successful in the response or not.

When the Option_flag is set, wait for EOF to respond. The Inventory_flag is not supported.

During the RF write cycle W t

, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the Configuration byte. The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer).

Table 184. Write Configuration request format

Request

SOF

Request_flags

8 bits

Write

Configuration

A1h

IC Mfg code

02h

UID

(1)

Pointer

64 bits 8 bits

Register

value (2)

8 bits -

1. This field is optional.

2. Before updating the register value, check the meaning of each bit in previous sections.

•

Request parameters:

• Request flags

• UID (optional)

CRC16

16 bits -

Request

EOF

Table 185. Write Configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Please refer to Table 11. System configuration memory map for details on register addresses.

Response parameter:

• No parameter. The response is sent back after the writing cycle.

Response SOF

Table 186. Write configuration response format when Error_flag is set

Response_flags

8 bits 8 bits

Error code

16 bits

CRC16

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option is not supported

– 0Fh: error with no information given

– 10h: block not available

– 12h: block already locked, content can't change

– 13h: the specified block was not successfully programmed

DS10925 - Rev 9 page 115/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

VCD

ST25DVxxx

Figure 56. Write Configuration exchange between VCD and ST25DVxxx

SOF

Write

Configuration request

EOF t

SOF

Write

Configuration response

EOF

Write Configuration sequence when error

W t

SOF

Write

Configuration response

EOF

7.6.28

Note:

Read Dynamic Configuration

On receiving the Read Dynamic Configuration command, the ST25DVxxx reads the Dynamic register address indicated by the pointer and sends back its 8-bit value in the response.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 187. Read Dynamic Configuration request format

Request SOF Request_flags

Read Dynamic

Configuration

IC Mfg code UID (1)

Pointer address CRC16 Request EOF

8 bits

1. This field is optional.

ADh 02h 64 bits 8 bits 16 bits -

Request parameters:

• UID (Optional)

Table 188. Read Dynamic Configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags Data

8 bits

CRC16

16 bits -

Response EOF

Response parameters:

• One byte of data

Please refer to Table 11. System configuration memory map for details on register addresses.

Table 189. Read Dynamic Configuration response format when Error_flag is set

Response SOF

8 bits

Response_flags error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error given with no information

– 10h: block not available

DS10925 - Rev 9 page 116/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.29

VCD

Figure 57. Read Dynamic Configuration frame exchange between VCD and ST25DVxxx

SOF

Read Dynamic

Configuration request

EOF

ST25DVxxx t

SOF

Read Dynamic

Configuration response

EOF

Write Dynamic Configuration

On receiving the Write Dynamic Configuration command, the ST25DVxxx updates the Dynamic register addressed by the pointer.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 190. Write Dynamic Configuration request format

Request

SOF

Request_flags

8 bits

1. This field is optional.

Write Dynamic

Configuration

AEh

IC Mfg code

02h

UID (1)

Pointer address

64 bits 8 bits

Register value

8 bits

•

Request parameters:

• Request flags

•

UID (Optional)

Pointer address

CRC16

16 bits -

Request

EOF

Table 191. Write Dynamic Configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameters:

• No parameter. The response is sent back after t

Table 192. Write Dynamic Configuration response format when Error_flag is set

Response SOF

8 bits

Response_flags error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: block not available

DS10925 - Rev 9 page 117/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

VCD

Figure 58. Write Dynamic Configuration frame exchange between VCD and ST25DVxxx

SOF

Write Dynamic

Configuration request

EOF

ST25DVxxx t

SOF

Write Dynamic

Configuration response

EOF

Write Dynamic

Configuration sequence when no error

ST25DVxxx t

SOF

Write Dynamic

Configuration response

EOF

Write Dynamic

Configuration sequence when error

7.6.30

Manage GPO

On receiving the Manage GPO command. Depending on the command argument, the ST25DV force the GPO output level if RF_USER interrupt is enabled, or send a pulse on GPO output if RF_INTERRUPT is enabled. If neither RF_USER nor RF_INTERRUPT was enabled, the command is not executed and ST25DVxxx responds an Error code “0F”.

The IT duration is defined by IT_TIME register and occurs just after the command response.

For the ST25DVxx-JF (CMOS output), a set means that the GPO pin is driven to a High level (V

DCG

) and a Reset pulls the GPO pin to a low level (V

The IT corresponds to a transmission of a positive pulse on the GPO pin.

For the ST25DVxx-IE (open drain output), a Set means that the GPO pin is driven to a low level (V

) and a

Reset releases the GPO (High impedance).

IT corresponds to the GPO pin driven to ground during the IT duration, then pin is released. Thanks to an external pull up, the high level will be recovered.

Option_flag is not supported. The Inventory_flag must be set to 0.

Request SOF Request_ flags

8 bits

1. This field is optional.

2. See

Table 194

Table 193. ManageGPO request format

ManageGPO IC Mfg code UID

(1)

A9h 02h

GPO VAL

64 bits 8 bits

(2)

CRC16 Request EOF

16 bits -

GPOVAL IT

0xxxxxx0b RF_USER enabled

0xxxxxx1b RF_USER enabled

1xxxxxxxb RF_INTERRUPT enabled

Any other conditions

Table 194. GPOVAL

ST25DVxx-IE (OD)

Pin pull to 0

Pin released (HZ)

GPO pin pulled to 0 during IT Time then released (HZ)

GPO released (Hz)

Request parameters:

•

Request flag

UID (optional)

Data: Define static or dynamic Interrupt

ST25DVxx-JF (CMOS)

GPO Pin set to logic One (V

DCG

)

GPO Pin reset to logic zero

GPO Pin drives a positive pulse

GPO pin reset to logic zero

DS10925 - Rev 9 page 118/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 195. ManageGPO response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the write cycle.

Response SOF

Table 196. ManageGPO response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 13h: the specified block was not successfully programmed (this error is generated if the ManageCPO

GPOVAL value is not in line with the GPO interrupts setting as specified in

Table 194. GPOVAL

)

Figure 59. Manage GPO frame exchange between VCD and ST25DVxxx

VCD SOF

ManageGPO request

EOF

ST25DVxxx t

SOF

ManageGPO response

EOF

7.6.31

Write Message

On receiving the Write Message command, the ST25DVxxx puts the data contained in the request into the

Mailbox buffer, update the MB_LEN_Dyn register, and set bit RF_PUT_MSG in MB_CTRL_Dyn register. It then reports if the write operation was successful in the response. The ST25DVxxx Mailbox contains up to 256 data bytes which are filled from the first location '00'. MSGlength parameter of the command is the number of Data bytes minus - 1 (00 for 1 byte of data, FFh for 256 bytes of data). Write Message could be executed only when

Mailbox is accessible by RF (fast transfer mode is enabled, previous RF message was read or time-out occurs, no I 2 C message to be read). User can check it by reading b1 of MB_CTRL_Dyn “HOST_PUT_MSG” which must be reset to “0”. The Option_flag is not supported. (refer to

Section 5.1 Fast transfer mode (FTM)

)

Request

SOF

Request_ flags

8 bits

Write

Message

AAh

Table 197. Write Message request format

IC Mfg code

02h

UID (1)

MSGLength

64 bits 1 byte

Message

Data

(MSGLength + 1) bytes

1. This field is optional.

Request parameters:

•

Request flags

UID (optional)

Message Length

Message Data

CRC16

Request

EOF

16 bits -

DS10925 - Rev 9 page 119/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 198. Write Message response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the write cycle.

Response SOF

Table 199. Write Message response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

Figure 60. Write Message frame exchange between VCD and ST25DVxxx

VCD SOF

Write Message request

EOF

ST25DVxxx t

SOF

Write Message response

EOF

Write sequence when error

ST25DVxxx t

SOF

Write Message response

EOF

7.6.32

Read Message Length

On receiving the Read Message Length command, the ST25DVxxx reads the MB_LEN_Dyn register which contains the Mailbox message length and sends back its 8-bit value in the response.

The value of MB_LEN_Dyn returned is the (size of the message length in Bytes - 1).

The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 200. Read Message Length request format

Request SOF Request_flags

8 bits

1. The field is optional.

Read Message Length

ABh

IC Mfg code

UID (1)

02h

CRC16

64 bits 16 bits -

Request EOF

Request parameters:

• UID (Optional)

DS10925 - Rev 9 page 120/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 201. Read Message Length response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags Data

8 bits

CRC16

16 bits -

Response EOF

Response parameters:

• One byte of data: MB_LEN_Dyn register value

Table 202. Read Message Length response format when Error_flag is set

Response SOF

8 bits

Response_flags error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error given with no information

Figure 61. Read Message Length frame exchange between VCD and ST25DVxxx

VCD SOF

Read Message

Length request

EOF

ST25DVxxx t

SOF

Read Message

Length response

EOF

7.6.33

Read Message

On receiving the Read Message command, the ST25DVxxx reads up to 256 byte in the Mailbox from the location specified by MBpointer and sends back their value in the response. First MailBox location is '00’. When Number of bytes is set to 00h and MBPointer is equals to 00h, the MB_LEN bytes of the full message are returned.

Otherwise, Read Message command returns (Number of Bytes + 1) bytes (i.e. 01h returns 2 bytes, FFh returns

256 bytes).

An error is reported if (Pointer + Nb of bytes + 1) is greater than the message length. RF Reading of the last byte of the mailbox message automatically clears b1 of MB_CTRL_Dyn “HOST_PUT_MSG”, and allows RF to put a new message.

The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 203. Read Message request format

Request

SOF

Request_flags

8 bits

1. This field is optional.

Read

Message

ACh

IC Mfg code

02h

UID (1)

MBpointer

64 bits 8 bits

Number of

Bytes

8 bits

Request parameters:

• Request flag

• UID (Optional)

CRC16

16 bits -

Request

EOF

DS10925 - Rev 9 page 121/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

•

Pointer (start at 00h)

Number of bytes is one less then the requested data

Table 204. Read Message response format when Error_flag is NOT set

Response SOF Response_flags

8 bits

Mailbox content

(Number of bytes + 1) bytes (1)

1. Number of message Bytes when Number of Bytes is set to 00h.

CRC16

16 bits -

Response EOF

Response parameters:

• (number of data + 1 ) data bytes

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

Figure 62. Read Message frame exchange between VCD and ST25DVxxx

VCD SOF

Read Message request

EOF

ST25DVxxx t

SOF

Read Message response

EOF

7.6.34

Fast Read Message

On receiving the Fast Read Message command, the ST25DVxxx reads up to 256 byte in the Mailbox from the location specified by MBpointer and sends back their value in the response. First MailBox location is '00’. When

Number of bytes is set to 00h and MBPointer is equals to 00h, the MB_LEN bytes of the full message are returned. Otherwise, Fast Read Message command returns (Number of Bytes + 1) bytes (i.e. 01h returns 2 bytes,

FFh returns 256 bytes).

An error is reported if (Pointer + Nb of bytes + 1) is greater than the message length..

RF Reading of the last byte of mailbox message automatically clears b1 of MB_CTRL_Dyn “HOST_PUT_MSG” and allows RF to put a new message.

The data rate of the response is multiplied by 2 compated to Read Message.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code. The Option_flag is not supported, and the Inventory_flag must be set to 0.

Request

SOF

Request_flags

8 bits

1. This field is optional

Request parameters:

• Request flag

Table 205. Fast Read Message request format

Fast Read

Message

CCh

IC Mfg code

02h

UID (1)

MBpointer

64 bits 8 bits

Number of

Bytes

8 bits

CRC16

16 bits

Request

EOF

DS10925 - Rev 9 page 122/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

•

UID (Optional)

Pointer (start at 00h)

Number of bytes is one less than the requested data

Table 206. Fast Read Message response format when Error_flag is NOT set

Response SOF

Response_flags

8 bits

Mailbox content

(Number of bytes + 1) bytes (1)

1. Number of message Bytes when Number of Bytes is set to 00h

CRC16

16 bits

Response EOF

64 bits

Response parameters:

• (number of bytes + 1) data bytes

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

Figure 63. Fast Read Message frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Read

Message request

EOF

ST25DVxxx t

SOF

Fast Read

Message response

EOF

7.6.35

Caution:

Write Password

On receiving the Write Password command, the ST25DVxxx uses the data contained in the request to write the password and reports whether the operation was successful in the response. It is possible to modify a

Password value only after issuing a valid Present password command (of the same password number). When the Option_flag is set, wait for EOF to respond. Refer to

Section 5.6 Data Protection for details on password

Management. The Inventory_flag must be set to 0.

During the RF write cycle time, W t

, there must be no modulation at all (neither 100% nor 10%), otherwise the

ST25DVxxx may not correctly program the data into the memory.

The W t

time is equal to t

1nom

+ N × 302 µs (N is an integer). After a successful write, the new value of the selected password is automatically activated. It is not required to present the new password value until the

ST25DVxxx power-down.

If ST25DVxxx is powered through V

, removing V

during Write Password command can abort the command. As a consequence, before writing a new password, RF user should check if V

is ON, by reading

EH_CTRL_Dyn register bit 3 (VCC_ON), and eventually ask host to maintain or to shut down V

, during the

Write Password command in order to avoid password corruption.

To make the application more robust, it is recommended to use addressed or selected mode during write password operations to get the traceability of which tags/UID have been programmed

DS10925 - Rev 9 page 123/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Request

SOF

Request_flags

8 bits

1. This field is optional.

Table 207. Write Password request format

Write password

B1h

IC Mfg code

02h

UID

(1)

64 bits

•

Request parameter:

• Request flags

UID (optional)

Password number:

– 00h = RF configuration password RF_PWD_0,

– 01h = RF_PWD_1,

– 02h = RF_PWD_2,

– 03h = RF_PWD_3,

•

– other = Error

Data

Password number

8 bits

Data

64 bits

CRC16

16 bits

Request

EOF

Table 208. Write Password response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• no parameter.

Response SOF

Table 209. Write Password response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 10h: the password number is incorrect

– 12h: update right not granted, Present Password command not previously executed successfully

– 13h: the specified block was not successfully programmed

DS10925 - Rev 9 page 124/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

VCD

ST25DVxxx

Figure 64. Write Password frame exchange between VCD and ST25DVxxx

SOF

Write

Password request

EOF t

SOF

Write

Password response

EOF

Write sequence when error

ST25DVxxx W t

SOF

Write

Password response

EOF

7.6.36

Present Password

On receiving the Present Password command, the ST25DVxxx compares the requested password with the data contained in the request and reports if the operation has been successful in the response. Refer to

Section 5.6 Data Protection for details on password Management. After a successful command, the security

session associate to the password is open as described in

Section 5.6 Data Protection .

The Option_flag is not supported, and the Inventory_flag must be set to 0.

Table 210. Present Password request format

Request

SOF

Request_flags

8 bits

1. This field is optional.

Present

Password

B3h

IC Mfg code

02h

UID

(1)

Password number

64 bits 8 bits

Password CRC16

64 bits 16 bits -

Request

EOF

Request parameter:

• Request flags

• UID (optional)

• Password Number:

– 00h = RF configuration password RF_PWD_0

– 01h = RF_PWD_1

– 02h = RF_PWD_2

– 03h = RF_PWD_3

– other = Error

• Password

Table 211. Present Password response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameter:

• No parameter. The response is sent back after the write cycle.

DS10925 - Rev 9 page 125/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response SOF

Table 212. Present Password response format when Error_flag is set

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: the present password is incorrect

– 10h: the password number is incorrect

Figure 65. Present Password frame exchange between VCD and ST25DVxxx

VCD SOF

Present

Password request

EOF

ST25DVxxx t

SOF

Present

Password response

EOF

7.6.37

Fast Read Single Block

On receiving the Fast Read Single Block command, the ST25DVxxx reads the requested block and sends back its 32-bit value in the response. When the Option_flag is set, the response includes the Block Security Status. The data rate of the response is multiplied by 2.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The Inventory_flag must be set to 0.

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Table 213. Fast Read Single Block request format

Request SOF Request_flags Fast Read Single Block IC Mfg code UID (1)

8 bits C0h 02h

Block number CRC16 Request EOF

64 bits 8 bits 16 bits -

1. This field is optional.

•

Request parameters:

• Request flags

UID (optional)

Block number

Table 214. Fast Read Single Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

Response_flags

8 bits

Block security status

(1)

8 bits

Data

32 bits

CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 126/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response parameters:

•

Table 215. Block security status

Four bytes of block data

) b

7 b

Reserved for future use

All at 0 b

5 b

Table 215. Block security status b

3 b

2 b

1 b

0: Current Block not locked

1: Current Block locked

Table 216. Fast Read Single Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 15h: the specified block is read-protected

Figure 66. Fast Read Single Block frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Read

Single Block request

EOF

ST25DVxxx t

SOF

Fast Read

Single Block response

EOF

7.6.38

Fast Extended Read Single Block

On receiving the Fast Extended Read Single Block command, the ST25DVxxx reads the requested block and sends back its 32-bit value in the response. When the Option_flag is set, the response includes the Block Security

Status. The data rate of the response is multiplied by 2.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The Inventory_flag must be set to 0.

Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command

DS10925 - Rev 9 page 127/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Request

SOF

8 bits

1. This field is optional.

Table 217. Fast Extended Read Single Block request format

Request_flags

Fast

Extended

Read Single

Block

C4h

IC Mfg code

02h

UID (1)

64 bits

Block number

16 bits

CRC16

16 bits

•

Request parameters:

• Request flags

UID (optional)

Block number (from LSB byte to MSB byte)

Request

EOF

Table 218. Fast Extended Read Single Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

Response_flags

8 bits

Block security status

(1)

8 bits

Data

32 bits

CRC16

16 bits -

Response EOF

Response parameters:

•

Block security status if Option_flag is set (see Table 219. Block security status

)

• Four bytes of block data b

7 b

6 b

Reserved for future use

All at 0 b

Table 219. Block security status b

3 b

2 b

1 b

0: Current Block not locked

1: Current Block locked

Table 220. Fast Extended Read Single Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: the specified block is not available

– 15h: the specified block is read-protected page 128/200

VCD

ST25DV04K ST25DV16K ST25DV64K

RF commands

Figure 67. Fast Extended Read Single Block frame exchange between VCD and ST25DVxxx

SOF

Fast Extended

Read Single Block request

EOF

ST25DVxxx t

SOF

Fast Extended

Read Single Block response

EOF

7.6.39

Fast Read Multiple Blocks

On receiving the Fast Read Multiple Blocks command, the ST25DVxxx reads the selected blocks and sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h up to the last block of user memory in the request, and the value is minus one (–1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed to 256 assuming that they are all located in the same area. If the number of blocks overlaps area or overlaps the end of user memory, the

ST25DVxxx returns an error code.

When the Option_flag is set, the response includes the Block Security Status. The data rate of the response is multiplied by 2.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The Inventory_flag must be set to 0.

Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed using this command.

Table 221. Fast Read Multiple Block request format

Request

SOF

Request_flags

Fast Read

Multiple Block

8 bits

1. This field is optional.

C3h

IC Mfg code

02h

UID

(1)

First block number

64 bits 8 bits

Number of blocks

8 bits

•

Request parameters:

• Request flag

• UID (Optional)

First block number

Number of blocks

CRC16

16 bits -

Request

EOF

Table 222. Fast Read Multiple Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

2. Repeated as needed.

Response_flags

8 bits

Block security status (1)

8 bits (2)

Data

32 bits (2)

CRC16

16 bits -

Response EOF

Response parameters:

•

Block security status if Option_flag is set (see Table 223. Block security status if Option_flag is set )

• N block of data

DS10925 - Rev 9 page 129/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands b

7 b

Reserved for future use

All at 0 b

Table 223. Block security status if Option_flag is set b

4 b

3 b

2 b

1 b

0: Current not locked

1: Current locked

Table 224. Fast Read Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 0Fh: error with no information given

– 03h: the option is not supported

– 10h: block address not available

– 15h: block read-protected

Figure 68. Fast Read Multiple Block frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Read

Multiple block request

EOF

ST25DVxxx t

SOF

Fast Read

Multiple block response

EOF page 130/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

7.6.40

Fast Extended Read Multiple Block

On receiving the Fast Extended Read Multiple Block command, the ST25DVxxx reads the selected blocks and sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h to up to the last block of memory in the request and the value is minus one (–1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed to 2047 assuming that they are all located in the same area. If the number of blocks overlaps several areas or overlaps the end of user memory, the ST25DVxxx returns an error code.

When the Option_flag is set, the response includes the Block Security Status. The data rate of the response is multiplied by 2.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The Inventory_flag must be set to 0.

Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and

ST25DV64K-xx can be addressed using this command.

Table 225. Fast Extended Read Multiple Block request format

Request

SOF

Request_flags

8 bits

1. This field is optional.

Fast Extended

Read Multiple

Block

C5h

IC Mfg code

02h

UID

(1)

First block number

64 bits 16 bits

Block

Number

16 bits

Request parameters:

•

Request flag

UID (Optional)

First block number (from LSB byte to MSB byte)

Number of blocks (from LSB byte to MSB byte)

CRC16

Request

EOF

16 bits -

Table 226. Fast Extended Read Multiple Block response format when Error_flag is NOT set

Response SOF

1. This field is optional.

2. Repeated as needed.

Response_flags

8 bits

Block security status (1)

8 bits (2)

Data

32 bits (2)

CRC16

16 bits -

Response EOF

Response parameters:

•

Block security status if Option_flag is set (see Table 223. Block security status if Option_flag is set )

• N block of data b

7 b

Reserved for future use All at 0 b

5 b

Table 227. Block security status if Option_flag is set b

3 b

2 b

1 b

0: Current not locked

1: Current locked

Table 228. Fast Read Multiple Block response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 131/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: the option is not supported

– 0Fh: error with no information given

– 10h: block address not available

– 15h: block read-protected

Figure 69. Fast Extended Read Multiple Block frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Extended

Read Multiple

Block request

EOF

ST25DVxxx t

SOF

Fast Extended

Read Multiple

Block response

EOF

7.6.41

Fast Write Message

•

On receiving the Fast Write Message command, the ST25DVxxx puts the data contained in the request into the mailbox buffer, updates the Message Length register MB_LEN_Dyn, and set Mailbox loaded bit RF_PUT_MSG.

It then reports if the write operation was successful in the response. The ST25DVxxx mailbox contains up to 256 data bytes which are filled from the first location '00'. MSGlength parameter of the command is the number of

Data bytes minus - 1 (00 for 1 byte of data, FFh for 256 bytes of data). Fast Write Message can be executed only when Mailbox is accessible by RF (previous RF message was read or time-out occurs, no I 2 C message to be read). User can check it by reading b1 of MB_CTRL_Dyn “HOST_PUT_MSG”, which must be reset to “0”. (refer to

Section 5.1 Fast transfer mode (FTM)

The data rate of the response is multiplied by 2 compared to Write Message command.

The Option_flag is not supported.

The Inventory_flag must be set to 0.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

Request

SOF

Request_flags

8 bits

Table 229. Fast Write Message request format

Fast Write

Message

IC Mfg code

UID (1)

MSGLength Message Data

CAh 02h 64 bits 1 byte

(MsgLenght + 1) bytes

1. This field is optional.

Request parameters:

•

Request flag

UID (optional)

Message Lenght

Message Data

CRC16

Request

EOF

16 bits -

Table 230. Fast Write Message response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

DS10925 - Rev 9 page 132/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Response parameters:

• No parameter. The response is sent back after the write cycle.

Table 231. Fast Write Message response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

Figure 70. Fast Write Message frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Write

Message request

EOF

ST25DVxxx t

SOF

Fast Write

Message response

EOF

Write sequence when error

ST25DVxxx t

SOF

Fast Write

Message response

EOF

Write sequence when no error

7.6.42

Fast Read Message Length

On receiving the Fast Read Message Length command, the ST25DV reads the MB_LEN_dyn register which contains the mailbox message length and sends back its 8-bit value in the response.

The value of MB_LEN_Dyn returned is the (size of the message length in Bytes - 1).

The Option_flag is not supported. The Inventory_flag must be set to 0.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The data rate of the response is multiplied by 2 compared to Read Message Length command.

Table 232. Fast Read Message Length request format

Request SOF Request_flags

8 bits

1. This field is optional.

Fast Read Message Length

CBh

IC Mfg code

02h

UID (1)

CRC16 Request EOF

64 bits 16 bits -

Request parameters:

• Request flag

• UID (optional)

DS10925 - Rev 9 page 133/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 233. Fast Read Message Length response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags Data

8 bits

CRC16

16 bits -

Response EOF

Response parameters:

• One byte of data: volatile Control register.

Table 234. Fast Read Message Length response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command option not recognized

– 03h: command not supported

– 0Fh: error with no information given

Figure 71. Fast Read Message Length frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Read

Message Length request

EOF

ST25DVxxx t

SOF

Fast Read

Message Length response

EOF

7.6.43

Fast Read Dynamic configuration

On receiving the Fast Read Dynamic configuration command, the ST25DVxxx reads the Dynamic register address by the pointer and sends back its 8-bit value in the response.

The Option_flag is not supported. The Inventory_flag must be set to 0.

The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

The data rate of the response is multiplied by 2 compared to Read Dynamic configuration command.

Table 235. Fast Read Dynamic configuration request format

Request SOF Request_flags

8 bits

Fast Read Dynamic configuration

CDh

1. This field is optional.

IC Mfg code UID (1)

Pointer address CRC16 Request EOF

02h 64 bits 8 bits 16 bits -

Request parameters:

• Request flag

• UID (optional)

DS10925 - Rev 9 page 134/200

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 236. Fast Read Dynamic configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags Data

8 bits

CRC16

16 bits -

Response EOF

Response parameters:

• One byte of data

Table 237. Fast Read Dynamic configuration response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: block not available

Figure 72. Fast Read Dynamic configuration frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Read

Dynamic configuration request

EOF

ST25DVxxx t

SOF

Fast Read

Dynamic configuration request

EOF

7.6.44

Fast Write Dynamic Configuration

On receiving the Fast Write Dynamic Configuration command, the ST25DV updates the Dynamic register addressed by the pointer.

The Option_flag is not supported. The Inventory_flag must be set to 0.

The data rate of the response is multiplied by 2 compared to Write Dynamic Configuration command.

Table 238. Fast Write Dynamic Configuration request format

Request

SOF

Request_flags

8 bits

1. This field is optional.

Fast Write

Dynamic

Configuration

CEh

IC Mfg code

02h

UID

(1)

Pointer address

64 bits 8 bits

Register

Value

8 bits

•

Request parameters:

• Request flag

• UID (optional)

Pointer address

CRC16

Request

EOF

16 bits -

DS10925 - Rev 9 page 135/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

RF commands

Table 239. Fast Write Dynamic Configuration response format when Error_flag is NOT set

Response SOF

8 bits

Response_flags CRC16

16 bits -

Response EOF

Response parameters:

• No parameter. The response is sent back after t

Table 240. Fast Write Dynamic Configuration response format when Error_flag is set

Response SOF

8 bits

Response_flags Error code

8 bits

CRC16

16 bits -

Response EOF

Response parameter:

• Error code as Error_flag is set:

– 02h: command not recognized

– 03h: command option not supported

– 0Fh: error with no information given

– 10h: block not available

Figure 73. Fast Write Dynamic Configuration frame exchange between VCD and ST25DVxxx

VCD SOF

Fast Write

Dynamic configuration request

EOF

ST25DVxxx

ST25DVxxx t

SOF

Fast Write

Dynamic configuration request

EOF

Write sequence when error

SOF

Fast Write

Dynamic configuration request

EOF

Write sequence when no error

page 136/200

ST25DV04K ST25DV16K ST25DV64K

Unique identifier (UID)

Unique identifier (UID)

•

The ST25DVxxx is uniquely identified by a 64-bit unique identifier (UID). This UID complies with ISO/IEC 15963 and ISO/IEC 7816-6. The UID is a read-only code and comprises:

• eight MSBs with a value of E0h, the IC manufacturer code “ST 02h” on 8 bits (ISO/IEC 7816-6/AM1), a unique serial number on 48 bits.

Table 241. UID format

63 56

0xE0

MSB

55 48

0x02

1. See

Table 85. UID for ST product code value definition.

47 40

ST product code

Stressing the device above the rating listed in Table 242. Absolute maximum ratings

LSB

39 0

Unique serial number

With the UID, each ST25DVxxx can be addressed uniquely and individually during the anticollision loop and for one-to-one exchanges between a VCD and an ST25DVxxx.

DS10925 - Rev 9 page 137/200

ST25DV04K ST25DV16K ST25DV64K

Device parameters

Device parameters

9.1

Maximum rating

may cause permanent damage to the device. These are stress ratings only and operation of the device, at these or any other conditions above those indicated in the operating sections of this specification, is not implied. Exposure to absolute maximum rating conditions for extended periods may affect the device reliability. Device mission profile

(application conditions) is compliant with JEDEC JESD47 qualification standard. Extended mission profiles can be assessed on demand.

Refer also to the STMicroelectronics SURE Program and other relevant quality documents.

Table 242. Absolute maximum ratings

Symbol

Ambient operating temperature

Parameter

Range 6

Range 8

All packages

UFDFPN8, UFDFPN12

SO8N, TSSOP

Min. Max.

Unit

RF and

I 2 C interfaces

-40 85 °C

RF and

I 2 C interfaces

- 40 105 °C

RF interface - 40 105 °C

I 2 C interface - 40 125 °C

STG t

STG

LEAD

DCG

OL_MAX_SDA

I 2

Supply GPO CMOS driver

C input or output range

C supply voltage

DC output current on pin SDA (when equal to 0)

OL_MAX_GPO_OD

DC output current on pin GPO open drain (when equal to 0)

MAX_1

MAX_2

ESD

Storage Temperature

Retain

Storage temperature

Lead temperature during soldering

Sawn wafer on UV tape kept in its original packing form

UFDFPN8 (MLP8),SO8N, TSSOP8, UFDFPN12, WLCSP10

- 65

150 see note

Electrostatic discharge voltage (human body model) (4)

- 0.50 6.5

1.5

°C months

°C

V mA mA

RF input voltage amplitude peak to peak between AC0 and AC1, V

SS pin left floating V

AC0

- V

AC1

AC voltage between AC0 and V

, or AC1 and V

AC0

- V

, or V

AC1

- V

11 V

- 0.50 5.5

All pins 2000 V

1. Counted from ST production date.

2. Compliant with JEDEC Std J-STD-020C (for small body, Sn-Pb or Pb assembly), the ST ECOPACK ®

7191395 specification, and the European directive on Restrictions on Hazardous Substances (RoHS)

2002/95/EU.

3. Based on characterization, not tested in production.

4. AEC-Q100-002 (compliant with JEDEC Std JESD22-A114, C1 = 100 pF, R1 = 1500 Ω, R2 = 500 Ω)

DS10925 - Rev 9 page 138/200

9.2

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the device in I 2 C mode. The parameters in the DC and AC characteristic tables that follow are derived from tests performed under the measurement conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters.

Symbol

Table 243. I 2 C operating conditions

Ambient operating temperature

Parameter

Supply voltage

Range 6

Range 8

All packages

UFDFPN8, UFDFPN12

SO8N, TSSOP8

Min.

Max.

Unit

1.8

-40

5.5

105

125

°C

Symbol

L t r,

t f

V hi-lo

V ref(t)

Table 244. AC test measurement conditions

Parameter

Load capacitance

Input rise and fall times

Input levels

Input and output timing reference levels

Min.

100

0.2V

to 0.8V

0.3V

to 0.7V

Max.

Input Levels

Figure 74. AC test measurement I/O waveform

Input and Output

Timing Reference Levels

0.8VCC

0.7VCC

0.3VCC

0.2VCC

Unit ns

Table 245. Input parameters

Symbol

IN t

Input capacitance (SDA)

Input capacitance (other pins)

Parameter

Pulse width ignored (Input filter on SCL and SDA)

1. Characterized only.

Symbol

Parameter

Input leakage current

(SCL, SDA)

Input leakage current

Table 246. I 2 C DC characteristics up to 85°C

Min.

Test condition

= V

orV

CC device in Standby mode

= V

Min.

Max.

Unit pF pF ns

Typ.

0.03

0.1

Max.

± 0.1

± 0.5

Unit

µA

DS10925 - Rev 9 page 139/200

Symbol

CC0

CC1

_MB

(LPD = 1)

IL_LPD

Parameter

(LPD)

Output leakage current

(SDA)

Operating Supply current (Device select E 2 Address) Read

Operating Supply current (Device

select MB Address) Read

Input low voltage (LPD)

Operating Supply current (Device select E 2 Address) Write

select MB Address) Write (1)

Operating Supply current (Device

Low Power Down supply current

CC1

_PON

(LPD = 0)

Static Standby supply current after power ON or device select stop or time out

Input low voltage (SDA, SCL)

Input high voltage (SDA, SCL)

Test condition device in Standby mode

SDA in Hi-Z, external voltage applied on SDA: V

or V

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V

= 3.3 V

= 5.5 V

= 1.8 V

= 3.3 V

= 5.5 V

= 1.8 V

= 3.3 V

= 5.5 V

= 3.3 V

= 1.8 V

= 3.3 V

= 5.5 V

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Min.

Typ.

Max.

Unit

510

116

220

0.03

116

220

510

110

130

170

280

520

0.84

1.3

1.7

- 0.45

0.75 V

300

600

1.5

100

120

0.25 V

0.3 V

0.2 V

+ 1

550

300

330

430

200

550

160

240

± 0.1

160

240

µA

DS10925 - Rev 9 page 140/200

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Symbol

_LPD

_SDA

Parameter

Input high voltage (LPD)

Output low voltage SDA (1 MHz)

Test condition

= 1.8 V

= 3.3 V

= 5.5 V

= 1 mA, V

= 1.8 V

= 2.1 mA, V

= 3.3 V

= 3 mA, V

= 5.5 V

_Powe r_up

Device Select Acknowledge f

= 100 KHz

1. SCL, SDA connected to Ground or V

CC.

SDA connected to V

through a pull-up resistor.

Min.

0.85 V

Typ.

0.05

0.075

0.09

1.48

Max.

+ 1

0.4

1.7

Symbol

_E 2

_MB

CC0

_MB

Parameter

Input leakage current

(SCL, SDA)

Input leakage current

(LPD)

Output leakage current

(SDA)

Table 247. I 2 C DC characteristics up to 125°C

Min.

Operating Supply current (Device select E 2 Address) Read

Operating Supply current (Device select MB Address) Read

Operating Supply current (Device select E 2 Address) Write

select MB Address) Write (1)

Operating Supply current (Device

Test condition

= V

orV

CC device in Standby mode

= V

SS device in Standby mode

SDA in Hi-Z, external voltage applied on SDA: V

or V

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V, f

= 1MHz

(rise/fall time < 50 ns)

= 3.3 V, f

= 1MHz

(rise/fall time < 50 ns)

Typ.

0.03

0.1

0.03

126

230

510

126

230

510

120

140

180

290

Max.

± 0.1

± 0.5

± 0.1

180

260

550

180

260

550

310

350

450

220

320

Unit

µA

Unit

µA

DS10925 - Rev 9 page 141/200

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Symbol Parameter Test condition Min.

(LPD = 1)

CC1

_PON

(LPD = 0)

CC0

IL_LPD

_MB

_LPD

_SDA

Operating Supply current (Device

select MB Address) Write

Static Standby supply current after power ON or device select stop or time out

Low Power Down supply current

Input low voltage (SDA, SCL)

Input low voltage (LPD)

Input high voltage (SDA, SCL)

Input high voltage (LPD)

Output low voltage SDA (1 MHz)

= 5.5 V, f

= 1MHz

(rise/fall time < 50 ns)

= 1.8 V

= 3.3 V

= 5.5 V

= 1.8 V

= 3.3 V

= 5.5 V

= 1.8 V

= 3.3 V

= 5.5 V

= 3.3 V

= 1.8 V

= 3.3 V

= 5.5 V

= 1.8 V

= 3.3 V

= 5.5 V

= 1 mA, V

= 1.8 V

= 2.1 mA, V

= 3.3 V

= 3 mA, V

= 5.5 V

_Powe r_up

Device Select Acknowledge f

= 100 KHz

1. SCL, SDA connected to Ground or V

CC.

SDA connected to V

through a pull-up resistor.

- 0.45

0.75 V

0.85 V

Typ.

520

2.5

0.05

0.08

0.1

1.48

Max.

600

110

130

0.25 V

0.3 V

0.2 V

+ 1

0.4

1.7

Symbol f

C t

CHCL t

CLCH t

START_OUT t

XH1XH2 t

XL1XL2 t

DL1DL2

(4)

DXCX t

CLDX t

CLQX

(5)

SCL t

HIGH t

LOW t

R t

F t

SU:DAT t

HD:DAT t

Alt.

Table 248. I 2 C AC characteristics up to 85°C

Test conditions specified in

Parameter Min.

Clock frequency

Clock pulse width high

Clock pulse width low

0.05

0.26

0.5

I²C timeout on Start condition

Input signal rise time

Input signal fall time

SDA (out) fall time

Data in set up time

Data in hold time

Data out hold time

100

Max.

1000

25000 (1)

25000 (2)

120

Unit

µA

µA ns ns ns ms ns ns ns kHz

µs

Unit

DS10925 - Rev 9 page 142/200

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Symbol f

C t

CHCL t

CLCH t

START_OUT t

XH1XH2 t

XL1XL2 t

DL1DL2

(4)

DXCX t

CLDX t

CLQX

(5)

CLQV

(6)

CHDX

(7)

Symbol Alt.

Test conditions specified in

time constant is less than 150 ns (as specified in the Figure 76. I 2 C Fast mode (f

Parameter Min.

Max.

CLQV

(6)

CHDX

(7)

DLCL t

CHDH t

AA t

SU:STA t

HD:STA t

SU:STO

Clock low to next data valid (access time)

Start condition set up time

Start condition hold time

Stop condition set up time

250

0.25

250 -

450

35000

DHDL t

BUF

Time between Stop condition and next Start condition

500 t

W t bootDC t bootLPD

I²C write time

(9)

RF OFF and LPD = 0

RF OFF -

0.6

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There is no min. or max. values for the input signal rise and fall times. It is however recommended by the

I 2 C specification that the input signal rise and fall times be less than 120 ns when f

< 1 MHz.

4. Characterized on bench.

5. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of SDA.

6. t

CLQV

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

compatible way with the I 2

in a

C bus

C specification (which specifies t

SU:DAT

(min) = 100 ns), assuming that the R bus

= 1 MHz): maximum

R bus

value versus bus parasitic capacitance (C bus

)

7. For a reStart condition, or following a write cycle.

8. t

DLCL

timeout.

9. I 2 C write time for 1 Byte, 2 Bytes, 3 Bytes or 4 Bytes in EEPROM (user memory and system configuration), provided they are all located in the same memory page, that is the most significant memory address bits

(b16-b2) are the same.

(8)

Alt.

SCL t

HIGH t

LOW t

SU:DAT t

HD:DAT t

DH t

AA t

SU:STA

R t

F t

Table 249. I 2 C AC characteristics up to 125°C

Test conditions specified in

Parameter Min.

Clock frequency 0.05

Clock pulse width high

Clock pulse width low

I²C timeout on Start condition

Input signal rise time

0.26

0.5

Input signal fall time

SDA (out) fall time

Data in set up time

Data in hold time

Data out hold time

100

Clock low to next data valid (access time)

Start condition set up time

250

Max.

1000

25000

25000

120

450

ns ms ms ms ns ns

µs ns

Unit ns ns ns ns ns

Unit kHz

µs

µs ms ns ns ns

DS10925 - Rev 9 page 143/200

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Symbol Alt.

Test conditions specified in

value versus bus parasitic capacitance (C bus

Parameter Min.

Max.

t t t

DLCL

CHDH

DHDL t t

HD:STA

SU:STO t

BUF

Start condition hold time

Stop condition set up time

Time between Stop condition and next Start condition

I²C write time

(9)

0.25

250

500 t

W t bootDC t bootLPD

RF OFF and LPD = 0

RF OFF -

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There is no min. or max. values for the input signal rise and fall times. It is however recommended by the

I 2 C specification that the input signal rise and fall times be less than 120 ns when f

< 1 MHz.

4. Characterized on bench.

5. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of SDA.

6. t

CLQV

C bus

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

compatible way with the I 2 C specification (which specifies t

SU:DAT

R bus

)

in a

(min) = 100 ns), assuming that the R bus

time constant is less than 150 ns (as specified in the Figure 76. I 2 C Fast mode (f

= 1 MHz): maximum

7. For a restart condition, or following a write cycle.

8. t

DLCL

timeout.

(b16-b2) are the same.

35000

(8)

5.5

0.6

ms ms ms

Unit

µs ns ns

DS10925 - Rev 9 page 144/200

DS10925 - Rev 9 t

XH1XH2

SCL

SDA In t

XL1XL2 t

DLCL

ST25DV04K ST25DV16K ST25DV64K

I2C DC and AC parameters

Figure 75. I 2 C AC waveforms t

CHCL t

CLCH t

CHDX

Start condition t

XH1XH2

SDA

Input t

CLDX SDA

Change t

DXCX

SCL

SDA In

SCL

SDA Out t

CHDH

Stop condition tCHCL t

CLQV tW

Write cycle

Data valid t

CLQX

Data valid t

XL1XL2 t

DL1DL2 t

CHDH t

DHDL

Start condition

Stop condition t

CHDX

Start condition

Figure 76. I 2 C Fast mode (f

= 1 MHz): maximum R bus

value versus bus parasitic capacitance (C bus

)

indicates how the value of the pull-up resistor can be calculated. In most applications, though, this method of synchronization is not employed, and so the pull-up resistor is not necessary, provided that the bus master has a push-pull (rather than open drain) output.

Figure 76. I 2 C Fast mode (f

= 1 MHz): maximum R bus

value versus bus parasitic capacitance (C bus

)

100

R bu s × C bu s

= 150

Here,

R bu s × Cbu s= 120 ns

10 30

Bus line capacitor (pF)

100

VCC

The R bus

x C bus

time constant must be below 150 ns.

The time constant line is represented on the left.

I²C bus master

SCL

SDA

Rbus

ST25DV

Cbus page 145/200

ST25DV04K ST25DV16K ST25DV64K

GPO characteristics

9.3

GPO characteristics

This section summarizes the operating and measurement conditions of the GPO feature. The parameters in the

DC and AC characteristic tables that follow are derived from tests performed under the measurement conditions summarized in the relevant tables.

Symbol

_GPO_CMOS

_GPO_OD

DGC

Parameter

Output low voltage

(GPO CMOS)

Output low voltage

(GPO open drain)

Output leakage

(GPO open drain)

Table 250. GPO DC characteristics up to 85°C

Output high voltage

(GPO CMOS)

Input leakage (V

DGC

)

Condition

DCG

= 1.8 V, I

= 0.5 mA

DCG

= 3.3 V, I

= 0.5 mA

DCG

= 5.5 V, I

= 0.5 mA

DCG

= 1.8 V, I

= - 0.5 mA

DCG

= 3.3 V, I

= - 0.5 mA

DCG

= 5.5 V, I

= - 0.5 mA

IOL = 1 mA, VCC = 1.8 V

IOL = 1 mA, VCC = 3.3 V

IOL = 1 mA, VCC = 5.5 V

GPO in Hi-Z, external voltage applied on:

GPO, V

or V

DGC

= 5.5 V

- 0.15

Min

DCG

- 0.4

DCG

- 0.4

DCG

- 0.4

Typ

0.28

0.20

0.06

Max

0.4

Unit

0.15

0.1

µA

Symbol

_GPO_CMOS

_GPO_OD

DGC

Parameter

Table 251. GPO DC characteristics up to 125°C

Output low voltage

(GPO CMOS)

Output high voltage

(GPO CMOS)

Output low voltage

(GPO open drain)

Output leakage

(GPO open drain)

Input leakage (V

DGC

)

Condition

DCG

= 1.8 V, I

= 0.5 mA

DCG

= 3.3 V, I

= 0.5 mA

DCG

= 5.5 V, I

= 0.5 mA

DCG

= 1.8 V, I

= - 0.5 mA

DCG

= 3.3 V, I

= - 0.5 mA

DCG

= 5.5 V, I

= - 0.5 mA

IOL = 1 mA, VCC = 1.8 V

IOL = 1 mA, VCC = 3.3 V

IOL = 1 mA, VCC = 5.5 V

GPO in Hi-Z, external voltage applied on

GPO: V

or V

DGC

= 5.5 V

Min

DCG

- 0.4

DCG

- 0.4

DCG

- 0.4

- 0.15

0.28

0.22

0.21

Typ

0.06

Symbol t r

_GPO_CMOS t f

_GPO_CMOS

Parameter

Output rise time

Output fall time

Table 252. GPO AC characteristics

Condition

= 30 pF, V

DCG

= 1.8 V to 5.5 V

= 30 pF, V

DCG

= 1.8 V to 5.5 V

Min

Max

Unit ns

0.4

Max

0.4

0.15

0.1

Unit

µA

DS10925 - Rev 9 page 146/200

ST25DV04K ST25DV16K ST25DV64K

RF electrical parameters

9.4

RF electrical parameters

This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the device in RF mode.

The parameters in the DC and AC characteristics tables that follow are derived from tests performed under the

Measurement Conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters.

Table 253. RF characteristics

Symbol f

H_ISO

Parameter

External RF signal frequency

Operating field according to ISO

Range 6

Range 8

Condition

= -40 °C to 85 °C

= -40 °C to 105 °C

Min

13.553

150

CARRIE

10% carrier modulation index (1)

MI=(A-B)/(A+B)

100% carrier modulation index

150 mA/m > H_ISO > 1000 mA/m 10

MI=(A-B)/(A+B) (2)

95 t

MIN

Minimum time from carrier generation to first data

Subcarrier frequency high

From H-field min -

W t f

SH t

2 t

3 f

SL t

_Block

Subcarrier frequency low

Time for ST25DVxxx response

Time between commands

RF User memory write time (including

internal Verify) (3)

/32

/28

4352/F

4192/F

4384/F

1 Block

4 Blocks

318.6

309

323.3

W t t

_Byte

_MB

Read_MB

RF system memory write time including internal Verify)

SOF to ST25DVxxx response EOF) (3)(4)

RF Mailbox write time (from VCD request

SOF to ST25DVxxx response EOF)

(3)(4)

RF Mailbox read time (from VCD request

1 Byte

256 Byte

256 Bytes -

TUN

BACK

MIN_1

Internal tuning capacitor (4)

Backscattered level as defined by ISO test

RF input voltage amplitude between AC0 and AC1, V

pin left floating, VAC0-VAC1 peak to peak

f = 13.56 MHz

Inventory and Read operations

Write operations

26.5

MIN_2

AC voltage between AC0 and V

SS between AC1 and V

Figure 77 shows an ASK modulated signal from the VCD to the ST25DVxxx. The test conditions for the AC/DC

or Inventory and Read operations

Write operations t

BootRF t

RF_OFF

Without DC supply (No V

RF OFF time

) Set up time

Chip reset

1. Characterized on bench.

2. Characterized at room temperature only, on wafer at POR Level.

3. For VCD request coded in 1 out of 4 and ST25DVxxx response in high data rate, single sub carrier.

4. The tuning capacitance value is measured with ST characterization equipment at chip Power On Reset.

This value is used as reference for antenna design. Minimum and Maximum values come from correlation with industrial tester limits.

Typ

13.56

423.75

484.28

320.9

311.5

5.2

19.7

4.9

80.7

28.5

4.8

5.25

2.25

2.7

0.6

Max

13.567

5000

100

323.3

314

30.5

Unit

MHz mA/m

% ms kHz kHz

µs

µs ms ms ms ms ms pF mV

V ms ms

DS10925 - Rev 9 page 147/200

Note:

ST25DV04K ST25DV16K ST25DV64K

RF electrical parameters

=-40 to 105°C. Characterized only.

All timing characterization where performed on a reference antenna witht the following characteristics:

• ISO antenna class 1

• Tuning frequency = 13.7 MHz.

Symbol

Table 254. Operating conditions

Parameter

Ambient operating temperature

Range 6

Range 8

Min.

-40

Max.

105

Unit

°C

•

parameters are:

•

Close coupling condition with tester antenna (1 mm)

ST25DVxxx performance measured at the tag antenna

ST25DVxxx synchronous timing, transmit and receive

Figure 77. ASK modulated signal tM IN CD

B tRFF tRFSBL tRFR fCC

DS10925 - Rev 9 page 148/200

10.1

ST25DV04K ST25DV16K ST25DV64K

Package information

Package information

In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK ® packages, depending on their level of environmental compliance. ECOPACK ® specifications, grade definitions and product status are available at: www.st.com

. ECOPACK ® is an ST trademark.

SO8N package information

SO8N is an 8-lead, 4.9 x 6 mm, plastic small outline, 150 mils body width, package.

Figure 78. SO8N – Outline h x 45˚

A2 A c ccc b e

0.25 mm

GAUGE PLANE k

E1 E

Drawing is not to scale.

Table 255. SO8N – Mechanical data

Symbol c

E1 e h k

L1 ccc

A2 b

Min.

0.100

1.250

0.280

0.170

4.800

5.800

3.800

0.250

0°

0.400

millimeters

Typ.

4.900

6.000

3.900

1.270

1.040

Max.

1.750

0.250

0.480

0.230

5.000

6.200

4.000

0.500

8°

1.270

0.100

Min.

0.0039

0.0492

0.0110

0.0067

0.1890

0.2283

0.1496

0.0098

0°

0.0157

1. Values in inches are converted from mm and rounded to four decimal digits.

inches

(1)

Typ.

0.1929

0.2362

0.1535

0.0500

0.0409

Max.

0.0689

0.0098

0.0189

0.0091

0.1969

0.2441

0.1575

0.0197

8°

0.0500

0.0039

DS10925 - Rev 9 page 149/200

ST25DV04K ST25DV16K ST25DV64K

TSSOP8 package information

Figure 79. SO8N - Recommended footprint

0.6 (x8)

10.2

1.27

Dimensions are expressed in millimeters.

TSSOP8 package information

TSSOP8 is an 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package.

Figure 80. TSSOP8 – Outline

8 5

E1 E

1 4

A b e

Drawing is not to scale.

α c

DS10925 - Rev 9 page 150/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

TSSOP8 package information

Table 256. TSSOP8 – Mechanical data

Symbol c

D e

A2 b

Min.

0.050

0.800

0.190

0.090

2.900

6.200

4.300

0.450

0° millimeters

Typ.

1.000

3.000

0.650

6.400

4.400

0.600

1.000

Max.

1.200

0.150

1.050

0.300

0.200

0.100

3.100

6.600

4.500

0.750

8°

Min.

0.0020

0.0315

0.0075

0.0035

0.1142

0.2441

0.1693

0.0177

0°

1. Values in inches are converted from mm and rounded to four decimal digits.

Figure 81. TSSOP8 – Recommended footprint

2.3

inches

(1)

Typ.

0.0394

0.1181

0.0256

0.2520

0.1732

0.0236

0.0394

1.0

Max.

0.0472

0.0059

0.0413

0.0118

0.0079

0.0039

0.1220

0.2598

0.1772

0.0295

8°

7.0

0.65

Dimensions are expressed in millimeters.

0.35

page 151/200

10.3

ST25DV04K ST25DV16K ST25DV64K

UFDFN8 package information

UFDFPN8 is an 8-lead, 2 × 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package.

Figure 82. UFDFN8 - Outline

D A B

Pin #1

ID marking

E ccc C

A1 eee C

Seating plane

Side view

2x aaa C

1 2

Top view

2x aaa C

1 2

D2 e

Pin #1

ID marking

L b

ND-1 x e

Bottom view

See Detail “A”

L L3

Datum A e/2 e

Detail “A”

Even terminal

Terminal tip

Max. package warpage is 0.05 mm.

Exposed copper is not systematic and can appear partially or totally according to the cross section.

Drawing is not to scale.

A1 e

L b

Symbol

0.450

Min

0.000

0.200

1.900

1.200

2.900

1.200

0.300

Table 257. UFDFN8 - Mechanical data millimeters

0.550

Typ

0.020

0.250

2.000

3.000

0.500

0.600

Max

0.050

0.300

2.100

1.600

3.100

1.600

0.500

0.0177

Min

0.0000

0.0079

0.0748

0.0472

0.1142

0.0472

0.0197

0.0118

inches

(1)

0.0217

Typ

0.0008

0.0098

0.0787

0.1181

0.0236

Max

0.0020

0.0118

0.0827

0.0630

0.1220

0.0630

0.0197

DS10925 - Rev 9 page 152/200

10.4

ST25DV04K ST25DV16K ST25DV64K

UFDFPN12 package information

Symbol

0.300

Min millimeters

Typ

0.150

0.100

0.050

0.080

Max

0.0118

Min inches

Typ

(1)

L3 aaa bbb ccc ddd eee

37.76 µs, as shown in Figure 88

1. Values in inches are converted from mm and rounded to 4 decimal digits.

2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip.

3. Applied for exposed die paddle and terminals. Exclude embedding part of exposed die paddle from measuring.

0.0059

0.0039

0.0020

0.0031

Max

UFDFPN12 package information

UFDFPN12 is an 12-lead, 3 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package.

Figure 83. UFDFPN12 - Outline

Pin #1 ID marking

E2 e

DS10925 - Rev 9

D D2 k

TOP VIEW

BOTTOM VIEW

SIDE VIEW

Drawing is not to scale.

Symbol

A (2)

Min

0.45

0.20

2.95

1.35

Table 258. UFDFPN12 - Mechanical data millimeters

Typ

0.55

0.25

3.00

1.40

Max

0.60

0.30

3.10

1.45

Min

0.0177

0.0079

0.1161

0.0531

inches (1)

Typ

0.0217

0.0098

0.1181

0.0551

Max

0.0236

0.0118

0.1220

0.0571

page 153/200

10.5

ST25DV04K ST25DV16K ST25DV64K

WLCSP10 package information

Symbol e

L k

Min

2.95

2.50

0.25

millimeters

Typ

0.50

3.00

2.55

0.30

0.40

Max

3.10

2.60

0.35

Min

0.1161

0.0984

0.0098

1. Values in inches are converted from mm and rounded to 4 decimal digits.

2. Package total thickness.

inches (1)

Typ

0.0197

0.1181

0.1004

0.0118

0.0157

Max

0.1220

0.1024

0.0138

WLCSP10 package information

Figure 84. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale package outline bbb Z

DETAIL A

Orientation reference

Y e J e1 E

SIDE VIEW TOP VIEW aaa

(4X)

BOTTOM VIEW

DETAIL A

ROTATED 90

BUMP eee Z b(10x) ccc M Z X Y dddM Z

SEATING PLANE

Drawing is not to scale.

Dimension is measured at the maximum bump diameter parallel to primary datum Z.

Primary datum Z and seating plane are defined by the spherical crowns of the bump.

Bump position designation per JESD 95-1, SPP-010.

Table 259. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale mechanical data

Symbol

0.265

Min millimeters

0.295

Typ

0.325

Max

0.0104

Min inches

(1)

0.0116

Typ

0.0128

Max

DS10925 - Rev 9 page 154/200

ST25DV04K ST25DV16K ST25DV64K

WLCSP10 package information

G aaa bbb ccc ddd eee

E e e1 b

Symbol

Min millimeters

Typ

0.095

0.175

0.025

0.185

1.649

1.483

0.400

0.800

0.346

1.039

0.200

0.314

0.342

0.110

0.060

1. Values in inches are converted from mm and rounded to 4 decimal digits.

1.503

1.669

Max Min inches

(1)

Typ

0.0079

0.0124

0.0135

0.0043

0.0024

0.0037

0.0069

0.0010

0.0073

0.0649

0.0584

0.0157

0.0315

0.0136

0.0409

Figure 85. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale recommended footprint

0.0657

0.0592

Max

DS10925 - Rev 9

Dpad

Dsm

Dimension

Pitch

Dpad

Dsm

Stencil opening

Stencil thickness

Table 260. WLCSP10 recommended PCB design rules

Recommended values

0.4 mm

0,225 mm

0.290 mm typ. (depends on soldermask registration tolerance)

0.250 mm

0.100 mm page 155/200

Note:

ST25DV04K ST25DV16K ST25DV64K

Ordering information

Ordering information

Example: ST25DV

Table 261. Ordering information scheme

64K

Device type

ST25DV = Dynamic NFC/RFID tag based on ISO 15693 and NFC T5T

-JF R 6

Memory size

04K = 4 Kbits

16K = 16 Kbits

64K = 64 Kbits

Device Features

IE = I 2 C & GPO open drain, fast transfer mode & Energy Harvesting

JF = I 2 C & GPO CMOS, fast transfer mode, energy harvesting & low power mode

Operating voltage

R = V

= 1.8 to 5.5 V

Device grade

6 = industrial: device tested with standard test flow over - 40 to 85 °C

8 = industrial device tested with standard test flow over -40 to 105 °C (UFDFPN8 and UFDFPN12 only) or over -40 to 125 °C (SO8N and TSSOP8 only, 105 °C only for RF interface)

Package

D = UFDFPN12

S = SO8N

T = TSSOP8

C = UFDFPN8 (Only for 04K version)

U = 725 µm +/- 20 µm unsawn wafer (Only for 04K version)

L = WLCSP (thin 10 balls) (Only for 04K version)

Capacitance

3 = 28.5 pF

D 3

Parts marked as “ES” or “E” are not yet qualified and therefore not approved for use in production. ST is not responsible for any consequences resulting from such use. In no event will ST be liable for the customer using any of these engineering samples in production. ST’s Quality department must be contacted prior to any decision to use these engineering samples to run a qualification activity.

DS10925 - Rev 9 page 156/200

ST25DV04K ST25DV16K ST25DV64K

Bit representation and coding for fast commands

A.1

A.1.1

Appendix A

Bit representation and coding for fast commands

Data bits are encoded using Manchester coding, according to the following schemes. For the low data rate, same subcarrier frequency or frequencies is/are used. In this case, the number of pulses is multiplied by 4 and all times increase by this factor. For the Fast commands using one subcarrier, all pulse numbers and times are divided by

Bit coding using one subcarrier

High data rate

For the fast commands, a logic 0 starts with four pulses at 423.75 kHz (f

/32) followed by an unmodulated time of

9.44 µs, as shown in

Figure 86 .

Figure 86. Logic 0, high data rate, fast commands

18.88 µs

For the Fast commands, a logic 1 starts with an unmodulated time of 9.44 µs followed by four pulses of 423.75

kHz (f

/32), as shown in

Figure 87 .

Figure 87. Logic 1, high data rate, fast commands

A.1.2

18.88 µs

Low data rate

For the Fast commands, a logic 0 starts with 16 pulses at 423.75 kHz (f

/32) followed by an unmodulated time of

Figure 88. Logic 0, low data rate, fast commands

75.52 µs

For the Fast commands, a logic 1 starts with an unmodulated time of 37.76 µs followed by 16 pulses at 423.75

kHz (f

/32), as shown in

Figure 89 .

DS10925 - Rev 9 page 157/200

ST25DV04K ST25DV16K ST25DV64K

ST25DVxxx to VCD frames

Figure 89. Logic 1, low data rate, fast commands

Note:

A.2

A.3

A.3.1

75.52 µs

For fast commands, bit coding using two subcarriers is not supported.

ST25DVxxx to VCD frames

Frames are delimited by an SOF and an EOF. They are implemented using code violation. Unused options are reserved for future use. For the low data rate, the same subcarrier frequency or frequencies is/are used. In this case, the number of pulses is multiplied by 4. For the Fast commands using one subcarrier, all pulse numbers and times are divided by 2.

SOF when using one subcarrier

High data rate

For the Fast commands, the SOF comprises an unmodulated time of 28.32 µs, followed by 12 pulses at 423.75

kHz (f

/32), and a logic 1 that consists of an unmodulated time of 9.44 µs followed by four pulses at 423.75 kHz, as shown in

Figure 90 .

Figure 90. Start of frame, high data rate, one subcarrier, fast commands

56.64 µs 18.88 µs

A.3.2

Low data rate

For the Fast commands, the SOF comprises an unmodulated time of 113.28 µs, followed by 48 pulses at 423.75

kHz (f

/32), and a logic 1 that includes an unmodulated time of 37.76 µs followed by 16 pulses at 423.75 kHz, as shown in

Figure 91 .

Figure 91. Start of frame, low data rate, one subcarrier, fast commands

226.56 µs 75.52 µs

DS10925 - Rev 9 page 158/200

A.4

A.4.1

ST25DV04K ST25DV16K ST25DV64K

EOF when using one subcarrier

High data rate

For the Fast commands, the EOF comprises a logic 0 that includes four pulses at 423.75 kHz and an unmodulated time of 9.44 µs, followed by 12 pulses at 423.75 kHz (f

/32) and an unmodulated time of 37.76

µs, as shown in

Figure 92 .

Figure 92. End of frame, high data rate, one subcarrier, fast commands

18.88 µs 56.64 µs

A.4.2

Low data rate

For the Fast commands, the EOF comprises a logic 0 that includes 16 pulses at 423.75 kHz and an unmodulated time of 37.76 µs, followed by 48 pulses at 423.75 kHz (f

/32) and an unmodulated time of 113.28 µs, as shown in

Figure 93 .

Figure 93. End of frame, low data rate, one subcarrier, fast commands

Note:

75.52 µs 226.56 µs

For SOF and EOF in fast commands, bit coding using two subcarriers is not supported.

DS10925 - Rev 9 page 159/200

B.1

B.2

B.2.1

ST25DV04K ST25DV16K ST25DV64K

I2C sequences

Appendix B

I2C sequences

Device select codes

Table 262. Device select usage

Device select value

Hexadecimal Binary

1010 E211 R/W

A6h

A7h

AEh

AFh

1010 0110b

1010 0111b

1010 1110b

1010 1111b

I2C Byte writing and polling

Comment

Device select generic

E2 = 0b User memory, Dynamic registers, FTM mailbox

E2 = 1b System memory

User memory, Dynamic registers, FTM mailbox writing

User memory, Dynamic registers, FTM mailbox reading

System memory writing

System memory reading

I2C byte write in user memory

Table 263. Byte Write in user memory when write operation allowed

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ACK

ADDRESS_MSB

ADDRESS_LSB

ACK

DATA

Stop

ACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data (1 Byte)

9th bit

Start of Programming

DS10925 - Rev 9 page 160/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C Byte writing and polling

Table 264. Polling during programming after byte writing in user memory

Request/Response Frame

Master drives SDA Slave drives SDA

Start

A6h

Start A6h

...

Start A6h

NoACK

...

Stop

ACK

Comment

Device select for writing

9th bit Device Busy

Device select for writing

9th bit Device Busy

... Device select for writing

... 9th bit Device Busy

Device select for writing

9th bit Device ready

Programing completed

End of Polling

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

DATA

Slave drives SDA

ACK

NoACK

Stop

Table 265. Byte Write in user memory when write operation is not allowed

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data

9th bit: Write access not granted or FTM activated.

No Programming

Device return in Standby page 161/200

B.2.2

ST25DV04K ST25DV16K ST25DV64K

I2C Byte writing and polling

I2C byte writing in dynamic registers and polling

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ADDRESS_MSB -

ACK

Dynamic Register ADDRESS_LSB

DATA

Stop

Table 266. Byte Write in Dynamic Register (if not Read Only)

ACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Dynamic register are located from address

2000h to 2007h , some are only readable

9th bit

Send Data

9th bit

Immediate update of Dynamic register

Table 267. Polling during programming after byte write in Dynamic Register

Request/Response Frame

Master drives SDA

Start A6h -

Slave drives SDA

Comment

Stop -

ACK

Device select for writing

9th bit Device Busy

Dynamic register updates is immediate

End of Polling

Table 268. Byte Write in Dynamic Register if Read Only

Start A6h

20h

Request/Response Frame

Master drives SDA Slave drives SDA

Comment

RO Dynamic Register ADDRESS_LSB -

DATA

Stop

ACK

NoACK

ACK

NoACK

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Addresses 2001h, 2004h, 2005h and 2007h are Read Only registers.

9th bit

Send Data

9th bit

No Programming

Device return in Standby

DS10925 - Rev 9 page 162/200

B.2.3

ST25DV04K ST25DV16K ST25DV64K

I2C Byte writing and polling

I2C byte write in mailbox and polling

Table 269. Byte Write in mailbox when mailbox is free from RF message and fast transfer mode is activated

Request/Response Frame

Master drives SDA

Start A6h

20h

08h

DATA

Stop

Slave drives SDA

ACK

Comment

Device select for writing

9th bit

Send mailbox address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Write must be done at first address of mailbox

9th bit

Send Data

9th bit

Immediate update of mailbox

Table 270. Byte Write in mailbox when mailbox is not free from RF message fast transfer mode is not activated

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

20h

ACK

08h

DATA

Stop

ACK

NoACK

Comment

Device select for writing

9th bit

Send mailbox address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Write must be done at first address of mailbox

9th bit

Send Data

9th bit Access

Mailbox busy or FTM not activated

No Programming

Device return in Standby

DS10925 - Rev 9 page 163/200

B.2.4

ST25DV04K ST25DV16K ST25DV64K

I2C Byte writing and polling

I2C byte write and polling in system memory

Table 271. Byte Write in System memory if I 2 C security session is open and register is not RO

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

ADDRESS_MSB

ADDRESS_LSB

DATA

Stop

ACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data

9th bit

Start of Programming

Table 272. Polling during programing after byte write in System memory if I 2 C security session is open and register is not RO

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

...

NoACK

Stop

ACK

Comment

Device select for writing

9th bit Device Busy

Device select for writing

9th bit Device Busy

Device select for writing

9th bit

Device select for writing

9th bit Device ready

Programing completed end of Polling

DS10925 - Rev 9 page 164/200

B.3

B.3.1

ST25DV04K ST25DV16K ST25DV64K

I2C sequential writing and polling

Table 273. Byte Write in System memory if I 2 C security session is closed or register is RO

Request/Response Frame

Master drives SDA

Start AEh

ADDRESS_MSB

ADDRESS_LSB

DATA

Stop

Slave drives SDA

ACK

NoACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data

9th bit

No Programming

Device return in Standby

I2C sequential writing and polling

I2C sequential write in user memory and polling

Table 274. Sequential write User memory when write operation allowed and all bytes belong to same area

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

DATA 0

DATA 1

...

Slave drives SDA

ACK

...

DATA n

Stop

ACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data 0

9th bit

Send Data 1

9th bit

...

Send Data n n ≤ 256

9th bit

Start of Programming

DS10925 - Rev 9 page 165/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential writing and polling

Table 275. Polling during programing after sequential write in User memory when write operation allowed and all bytes belong to same area.

Request/Response Frame

Master drives SDA

Start A6h

Slave drives SDA

NoACK

...

Stop

ACK

Comment

Device select for writing

9th bit Device Busy

Device select for writing

9th bit Device Busy

Device select for writing

9th bit Device Busy

Device select for writing

9th bit Device ready

Programing completed

End of Polling

Table 276. Sequential write in User memory when write operation allowed and crossing over area border

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ACK

ADDRESS_MSB

ADDRESS_LSB

ACK

DATA 0

DATA 1

...

ACK

...

DATA n

Stop -

NoACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Send Data 0

9th bit

Send Data 1

9th bit

...

Send Data n

Address is located in next memory area

9th bit

No programming

Device return in Standby page 166/200

B.3.2

ST25DV04K ST25DV16K ST25DV64K

I2C sequential writing and polling

Table 277. Polling during programming after sequential write in User memory when write operation allowed and crossing over area border

Slave drives SDA Master drives SDA

Request/Response Frame

Start A6h -

Comment

Stop

ACK

Device select for writing

9th bit Device ready

No programming

End of Polling

I2C sequential write in mailbox and polling

Table 278. Sequential write in mailbox when mailbox is free from RF message and fast transfer mode is activated

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

DATA 0

DATA 1

...

Slave drives SDA

ACK

...

DATA n

Stop

ACK

Comment

Device select for writing

9th bit

Send mailbox Address MSB (1 Byte)

9th bit

Send mailbox Address LSB (1 Byte)

9th bit

Send Data 0

9th bit

Send Data 1

9th bit

...

Send Data n n ≤ 256

9th bit

Immediate mailbox content update

Table 279. Polling during programing after sequential write in mailbox

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h -

Comment

Stop

ACK

Device select for writing

9th bit Device ready

Mailbox is immediately updated

End of Polling

DS10925 - Rev 9 page 167/200

B.4

B.4.1

ST25DV04K ST25DV16K ST25DV64K

I2C Read current address

I2C current address read in User memory

Table 280. Current byte Read in User memory if read operation allowed (depending on area protection and

RF user security session)

Request/Response Frame

Master drives SDA Slave drives SDA

Start A7h

ACK

NO_ACK

Stop

DATA

Comment

Device select for reading

9th bit

Receive Data located on last pointed address+1, or at address 0 after power-up, in user memory

9th bit

End of Reading

Table 281. Current Read in User memory if read operation not allowed (depending on area protection and

RF user security session)

Request/Response Frame

Master drives SDA Slave drives SDA

Start A7h

ACK

Comment

NO_ACK

Stop

FFh

Device select for reading

9th bit

Read of data not allowed

ST25DV release SDA

9th bit

End of Reading

DS10925 - Rev 9 page 168/200

B.5

B.5.1

ST25DV04K ST25DV16K ST25DV64K

I2C random address read

I2C random address read in user memory

Table 282. Random byte read in User memory if read operation allowed (depending on area protection and

RF user security session)

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

Start A7h

NO_ACK

Stop

ACK

DATA

ACK

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data

9th bit

End of Reading

Table 283. Random byte read in User memory if operation not allowed (depending on area protection and

RF user security)

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

Start A7h

Slave drives SDA

ACK

NO_ACK

Stop

FFh

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Read of data not allowed release SDA

9th bit

End of Reading

DS10925 - Rev 9 page 169/200

B.5.2

B.5.3

ST25DV04K ST25DV16K ST25DV64K

I2C random address read

I2C Random address read in system memory

Table 284. Byte Read System memory (Static register or I2C Password after a valid Present I2C Password)

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

ADDRESS_MSB

ADDRESS_LSB

Start AFh

NO_ACK

Stop

ACK

DATA

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data

9th bit

End of reading

I2C Random address read in dynamic registers

Table 285. Random byte read in Dynamic registers

Request/Response Frame

Master drives SDA

Start A6h

20h

ADDRESS_LSB

Start A7h

NO_ACK

Stop

Slave drives SDA

ACK

DATA

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Adress LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data

9th bit

End of reading

DS10925 - Rev 9 page 170/200

B.6

B.6.1

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

I2C sequential read in user memory

Table 286. Sequential Read User memory if read operation allowed (depending on area protection and RF user security session) and all bytes belong to the same area

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

Start A7h0

ACK

...

NO_ACK

Stop

ACK

DATA 0

ACK

DATA 1

...

DATA n

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data n

9th bit

End of Reading

DS10925 - Rev 9 page 171/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

Table 287. Sequential Read User memory if read operation allowed (depending on area protection and RF user security session) but crossing area border

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

Start A7h

ACK

...

ACK

Slave drives SDA

ACK

DATA 0

DATA 1

...

DATA n

ACK

...

Stop

FFh

...

FFh

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data last Address available

9th bit

Data is located in next memory area

ST25DV release SDA

9th bit

...

Data is located in next memory area

ST25DV release SDA

End of reading page 172/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

Table 288. Sequential Read User memory if read operation allowed (depending on area protection and RF user security session)

Request/Response Frame

Master drives SDA

Start A6h

ADDRESS_MSB

ADDRESS_LSB

Start A7h

Slave drives SDA

ACK

...

NO_ACK

Stop

FFh

...

FFh

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

ST25DV release SDA

Reading access not granted

9th bit

...

ST25DV release SDA

Reading access not granted

9th bit

End of reading page 173/200

B.6.2

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

I2C sequential read in system memory

Table 289. Sequential in Read System memory (I 2 C security session open if reading I2C_PWD)

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

ADDRESS_MSB

ADDRESS_LSB

Start AF7h

ACK

...

NO_ACK

Stop

ACK

DATA

ACK

DATA

...

DATA

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data n

9th bit

End of Reading

DS10925 - Rev 9 page 174/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

Table 290. Sequential Read system memory when access is not granted (I 2 C password I2C_PWD)

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

90h

ADDRESS_LSB

Start AFh

ACK

DATA

ACK

...

NO_ACK

Stop

FFh

...

FFh

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

9th bit

Device select for reading

9th bit

Receive Data 0

ST25DV release SDA

Reading access is not granted

9th bit

...

ST25DV release SDA

Reading access is not granted

9th bit

End of reading page 175/200

B.6.3

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

I2C sequential read in dynamic registers

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

20h

ACK

Dynamic register ADDRESS_LSB

Start A7h

ACK

...

NO_ACK

Stop

Table 291. Sequential read in dynamic register

...

Data

ACK

DATA

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Fynamic register are located form address

2000h to 2007

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data n

9th bit

End of reading

DS10925 - Rev 9 page 176/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

Table 292. Sequential read in Dynamic register and mailbox continuously if fast transfer mode is activated

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

20h

ACK

Dynamic Register

ADDRESS_LSB

Start A7h

ACK

...

ACK

...

NO_ACK

Stop

ACK

DATA 0

DATA 1

...

DATA n

DATA n + 1

DATA n + 2

...

Data n + i

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

9th bit

Send Address LSB (1 Byte)

Dynamic register are located from address

2000h to 2007h

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data n (n ≤ 8)

Last Dynamic register address 2007h

9th bit

Mailbox byte 0

9th bit

Mailbox byte 1

9th bit

...

Mailbox byte i (i < 256)

9th bit

End of reading page 177/200

B.6.4

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

I2C sequential read in mailbox

Table 293. Sequential in mailbox if fast transfer mode is activated

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ACK

20h or 21h

ADDRESS_LSB

Start A7h

ACK

...

NO_ACK

Stop

ACK

...

Data n

ACK

DATA 0

DATA 1

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

2007h < @ 2108h

9th bit

Send Address LSB (1 Byte)

2007h < @ 2108h

9th bit

Device select for reading

9th bit

Receive Data 0

9th bit

Receive Data 1

9th bit

...

Receive Data n

9th bit

End of reading

DS10925 - Rev 9 page 178/200

DS10925 - Rev 9

ST25DV04K ST25DV16K ST25DV64K

I2C sequential read

Request/Response Frame

Master drives SDA Slave drives SDA

Start A6h

ACK

20h or 21h

Table 294. Sequential read in mailbox if fast transfer mode is not activated

ADDRESS_LSB

Start A7h

ACK

...

NO_ACK

Stop

ACK

FFh

...

ACK

FFh

Comment

Device select for writing

9th bit

Send Address MSB (1 Byte)

2007h < @ 2108h

9th bit

Send Address LSB (1 Byte)

2007h < @ 2108h

9th bit

Device select for reading

9th bit release SDA

9th bit

...

release SDA

9th bit

End of reading page 179/200

B.7

B.7.1

ST25DV04K ST25DV16K ST25DV64K

I2C password relative sequences

I2C write password

Table 295. Write Password when I2C security session is already open and fast transfer mode is not activated

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

09h

00h

I2C_PWD_BYTE_7

I2C_PWD_BYTE_6

...

I2C_PWD_BYTE_0

07h

I2C_PWD_BYTE_7

I2C_PWD_BYTE_6

...

I2C_PWD_BYTE_0

Stop -

ACK

DATA 0

ACK

...

ACK

...

ACK

DATA 0

ACK

Comment

Device select for writing

9th bit

Send I2C_PWD MSB address

9th bit

Send I2C_PWD LSB address

9th bit

Send I2C_PWD MSB

9th bit

Send Data

9th bit

...

Send I2C_PWD LSB

9th bit

Write password command

9th bit

Send I2C_PWD MSB

9th bit

Send Data

9th bit

...

Send I2C_PWD LSB

9th bit

Start of I 2 C password programming

DS10925 - Rev 9 page 180/200

ST25DV04K ST25DV16K ST25DV64K

I2C password relative sequences

Table 296. Write Password when I2C security session is not open or fast transfer mode activated

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

09h

00h

ACK

NoACK

Stop -

Comment

Device select for writing

9th bit

Send I2C_PWD MSB address

9th bit

Send I2C_PWD LSB address

9th bit

No PWD Programming

Device return in Standby

DS10925 - Rev 9 page 181/200

B.7.2

ST25DV04K ST25DV16K ST25DV64K

I2C password relative sequences

I2C present password

Table 297. Present Password (whatever status of I 2 C security session or fast transfer mode)

Request/Response Frame

Master drives SDA Slave drives SDA

Start AEh

09h

00h

I2C_PWD_BYTE_7

I2C_PWD_BYTE_6

...

I2C_PWD_BYTE_0

09h

I2C_PWD_BYTE_7

I2C_PWD_BYTE_6

...

I2C_PWD_BYTE_0

ACK

...

ACK

...

ACK

DATA 0

ACK

Stop -

Comment

Device select for writing

9th bit

Send I2C_PWD MSB address

9th bit

Send I2C_PWD LSB address

9th bit

Send I2C_PWD MSB

9th bit

Send Data

9th bit

...

Send I2C_PWD LSB

9th bit

Present password command

9th bit

Send I2C_PWD MSB

9th bit

Send Data

9th bit

...

Send I2C_PWD LSB

9th bit

ST25DV with active I2C_PWD.

Result is immediate.

DS10925 - Rev 9 page 182/200

ST25DV04K ST25DV16K ST25DV64K

Revision history

Date

23-Feb-2017

20-Sep-2017

04-Oct-2017

19-Dec-2017

Revision

Table 298. Document revision history

Changes

Initial release.

•

Updated:

Features

Section 4 Memory management

Section 5 ST25DVxxx specific features

Section 5.6.4 System memory protection

Section 6.4.2 I2C Sequential write

Section 6 I2C operation

Section 7 RF operations

Section 9.1 Maximum rating

Table 158. Get System Info response format Error_flag is NOT set

Table 242. Absolute maximum ratings

Table 244. AC test measurement conditions

Table 246. I 2 C DC characteristics up to 85°C

Table 248. I 2 C AC characteristics up to 85°C

Table 250. GPO DC characteristics up to 85°C

Table 253. RF characteristics

Table 254. Operating conditions

Table 256. TSSOP8 – Mechanical data

Table 261. Ordering information scheme

Figure 30. I 2 C Present Password Sequence

Figure 31. I 2 C Write Password Sequence

Figure 80. TSSOP8 – Outline

•

Added:

Table 159. Memory size

Table 243. I 2 C operating conditions

Table 247. I 2 C DC characteristics up to 125°C