STMicroelectronics ST25TA02KB-D Datasheet
Reklama
Reklama
ST25TA512B, ST25TA02KB
ST25TA02KB ‑ D, ST25TA02KB ‑ P
Datasheet
NFC Forum Type 4 Tag IC with up to 2-Kbit EEPROM
UFDFPN5
(1.7x1.4mm)
Wafer
Product status link
ST25TA512B
ST25TA02KB
ST25TA02KB-D
ST25TA02KB-P
Features
Contactless interface
• NFC Forum Type 4 Tag, certified by the NFC Forum
• ISO/IEC 14443 Type A
• 106 kbps data rate
• Internal tuning capacitance: 50 pF
Memory
• Up to 256-byte (2-Kbit) EEPROM
• Support NDEF data structure
• Data retention: 200 years
• Endurance: 1 million erase-write cycles
• Read up to 256 bytes in a single command
• Write up to 54 bytes in a single command
• Chaining capability
• 7-byte unique identifier (UID)
• 128-bit password protection
• 20-bit event counter with anti-tearing
Product identification and protection
• TruST25™ digital signature
Package
• UFDFPN5 ECOPACK ® 2
Digital output
• GPO: configurable general purpose output
– driven by an open drain transistor, available on ST25TA02KB-D only
– enabling no DC consumption (CMOS output buffer), available on
ST25TA02KB-P only.
Description
The ST25TA512B and ST25TA02KB devices are NFC tag ICs, with an optional general purpose output available on ST25TA02KB-D and ST25TA02KB-P.
They embed an up to 2 -Kbit EEPROM, and can be operated from a 13.56 MHz
RFID reader or an NFC phone.
The ST25TA512B, ST25TA02KB,
ST25TA02KB-D and ST25TA02KB-P devices are NFC Forum Type 4 Tags.
They communicate using the ISO/IEC 14443 Type A protocol, and feature a digital signature generated by TruST25™ (a set of software and procedures) used to prove the origin of the chip in cloning detection.
DS12365 - Rev 2 - September 2018
For further information contact your local STMicroelectronics sales office.
www.st.com
1
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Functional description
Functional description
The ST25TA512B , ST25TA02KB , ST25TA02KB-D and ST25TA02KB-P (hereinafter referred to as ST25TAxxxB) devices are NFC tags that can be accessed from the RF interface, based on the ISO/IEC 14443 Type A standard.
The ST25TAxxxB are compatible with the NFC Forum Type 4 Tag specifications and support all corresponding commands.
,
and Figure 3 show the block diagram, respectively, of the ST25TA02KB/ST25TA512B,
ST25TA02KB-D and ST25TA02KB-P devices.
Figure 1. Block diagram - ST25TA02KB and ST25TA512B
RF interface based on
ISO/IEC 14443
Type A standard
AC1
AC0
Analog Front-end based on
ISO/IEC 14443
Type A standard
Internal tuning capacitance
Power management unit
UID and
System area
Digital unit
NFC Forum
Type 4 tag protocol
User memory
RF interface based on
ISO/IEC 14443
Type A standard
GPO f (V
DCG
)
AC1
AC0
V
DCG
GPO
V
SS
Figure 2. Block diagram - ST25TA02KB-P
Analog Front-end based on
ISO/IEC 14443
Type A standard
Internal tuning capacitance
Power management unit
Digital unit
NFC Forum
Type 4 tag protocol
UID and
System area
User memory
DS12365 - Rev 2 page 2/62
RF interface based on
ISO/IEC 14443
Type A standard
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Functional description
AC1
AC0
Figure 3. Block diagram - ST25TA02KB-D
Analog Front-end based on
ISO/IEC 14443
Type A standard
Internal tuning capacitance
Power management unit
UID and
System area
GPO
V
SS
Digital unit
NFC Forum
Type 4 tag protocol
User memory
DS12365 - Rev 2
Table 1. Signal names
Signal name
AC0, AC1
V
DCG
V
SS
Antenna coils
Ground
Interrupt output
Function
Supply voltage for CMOS GPO driver
1. Only available on ST25TA02KB-P.
2. Only available on ST25TA02KB-P and ST25TA02KB-D .
Direction
-
Power
-
CMOS or Open drain output
Figure 4. 5-pin package connections - ST25TA02KB-D
GPO 1
V
SS
AC0
2
3
ABCD
XYZW
Top view
(marking side)
5
2
4
NC
V
SS
AC1
5
2
4
Bottom view
(pads side)
1
2
3
1.
See Section 13 Package information
for package dimensions, and how to identify pin 1.
Figure 5. 5-pin package connections - ST25TA02KB-P
GPO 1
V
SS
AC0
2
3
ABCD
XYZW
Top view
(marking side)
5
2
4
V
DCG
V
SS
AC1
5
2
4
Bottom view
(pads side)
1
2
3
1.
See Section 13 Package information
for package dimensions, and how to identify pin 1.
page 3/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Functional mode
1.1
Functional mode
The ST25TAxxxB have only one functional mode available (see Table 2 ).
Mode
Tag mode
Supply source
RF field only
Table 2. Functional mode
Comments
The RF interface operates only when RF field level is sufficient.
The optional GPO open drain transistor requests an external pull-up (> 4.7 KΩ) to operate (see
).
Figure 6. Applicative example of GPO usage - ST25TA02KB-D
+
≥ 4.7 kΩ
V
DD
AC0
RF antenna IO GPO
AC1
V
SS
ST25TA02KB-D Microcontroller
The optional GPO CMOS driver requests an external supply to operate (see
).
DS12365 - Rev 2 page 4/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Functional mode
Figure 7. Applicative example of GPO usage - ST25TA02KB-P
+
RF antenna
V
DCG
AC0
GPO
AC1
V
SS
ST25TA02KB-P
+
10 nF
IO
V
DD
Microcontroller
1.1.1
Tag mode
The ST25TAxxxB are supplied by the RF field and can communicate with an RF host (RFID reader or NFC phone). The User memory can be accessed by the RF commands.
DS12365 - Rev 2 page 5/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Signal description
2
2.1
2.2
2.3
2.3.1
2.3.2
2.4
Signal description
Antenna coil (AC0, AC1)
These inputs are used to connect the ST25TAxxxB devices to an external coil exclusively. It is advised not to connect any other DC or AC path to neither AC0 nor AC1.
When correctly tuned, the coil is used to access the devices using NFC Forum Type 4 commands.
Ground (V
SS
), only available on ST25TA02KB-P and ST25TA02KB-D
V
SS
, when connected, is the reference for the V
DCG
supply voltage and for all pads, including AC0 and AC1.
GPO supply voltage (V
DCG
), only available on ST25TA02KB-P
This pin can be connected to an external DC supply voltage. It only supplies the GPO driver block.
Operating supply voltage V
DCG
Before checking ST25TA02KB-P GPO, a valid and stable V
DCG
voltage within the specified [V
DCG(min)
,
V
DCG(max)
] range must be applied.
To maintain a stable DC supply voltage, it is recommended to decouple the V
DCG
line with suitable capacitors
(usually of the order of 10 nF and 100 pF) close to the V
DCG
/ V
SS
package pins.
This voltage must remain stable and valid until the end of the GPO usage by the ST25TA02KB-P.
Power-up conditions
The V
DCG
rise time must not vary faster than 1 V / μs.
General purpose output (GPO), only available on ST25TA02KB-P and
ST25TA02KB-D
The GPO pad is either an open drain pad on which an external pull-up resistor shall be connected, or a CMOS pad with default polarity set to 0.
This pad is a configurable output signal, driven to active level when configured events occur. Its behavior is
for more details.
DS12365 - Rev 2 page 6/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ST25TAxxxB memory management
3
3.1
3.1.1
3.1.2
ST25TAxxxB memory management
Memory structure
•
•
The ST25TAxxxB support the NDEF Tag Application as defined in the NFC Forum Type 4 Tag. They are composed of three files:
• a Capability Container (CC) file an NDEF file a System file: this file is an ST-proprietary file
The System file contains some information on the configuration of the ST25TAxxxB devices. The CC file gives some information about the ST25TAxxxB and the NDEF file. The NDEF file contains the User data.
File identifier
The file identifier is the value used in the Select command to select a file.
Table 3. File identifier
File identifier Meaning
0xE101
0xE103
0x0001
System file
CC file
NDEF file
CC file layout
The CC file gives some information about the ST25TAxxxB and the NDEF file. This file is a read-only file for the
RF host and cannot be modified by issuing a write command.
The T field, Read Access and Write Access fields can be changed by the RF host by issuing a specific process
(refer to
Section 7 Functional procedures
).
Table 4. CC file layout
File offset
0x0000
0x0002
0x0003
0x0005
0x0007
0x0008
0x0009
Length CC file
Mapping version
Meaning
MLe: Maximum number of bytes that can be read
Value
0x000F 15 bytes
0x20 or 0x10 V 2.0 or V 1.0
Comments
0x0040
64 bytes
MLc: Maximum number of bytes that can be written 0x0036
0x06
0x0001
54 bytes
T field
L field
FileID
0x000B
0x000D
0x000E
NDEF file control TLV
FLEN: Maximum NDEF file size in Bytes
CCRD: Read access condition
CCWR: Write access condition
1. According to the reader command format the ST25TAxxxB devices will automatically align to the corresponding NFC Forum version.
2. ST25TA02KB, ST25TA02KB-D and ST25TA02KB-P.
DS12365 - Rev 2 page 7/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Memory structure
3.1.3
3. ST25TA512B.
4. Delivery state.
NDEF file layout
The NDEF file contains the NDEF message that contains the User data. The RF host can read and write data inside the file. The first two bytes named NDEF Message Length define the size of the NDEF message. The
NDEF Message Length shall be managed by the application and the ST25TAxxxB devices do not check if its value is relevant vs. the data written by the RF host. If the NDEF Message Length value stored in the file is greater than FLEN-2 (NDEF Message Length > FLEN-2 can occur because of a successful UpdateBinary command with wrong value, or because of a corrupted UpdateBinary command.) the tag handles it as an invalid case and returns 0x00 for the byte values at offsets 0x0000 and 0x0001 in the response to a ReadBinary command.
For more details about the read command, refer to Section 6.7.5 ReadBinary command
Table 5. NDEF file layout
File offset
0x0000
0x0004
...
...
...
0x00FC
...
...
...
Byte 0
NDEF Message Length
User data
...
1. ST25TA02KB, ST25TA02KB-D and ST25TA02KB-P.
2. ST25TA512B.
Byte 1
User data
...
...
...
...
Byte 2
...
...
...
User data
User data
...
Byte 3
User data
User data
...
...
...
User data
DS12365 - Rev 2 page 8/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Memory structure
3.1.4
System file layout
The system file specifies the configuration of the ST25TAxxxB devices.
lists the different fields.
Table 6. Field list
File offset
0x0000
0x0002
0x0003
0x0004
0x0007
0x0008
0x000F
0x0011
Length system file
ST reserved
GPO Config
Event Counter Config 1
20-bit counter
(MS nibble 0x0)
Product version
UID
Field name
Memory Size - 1
IC reference code
No. of bytes Read access Write access
2 Yes -
Device(s)
ST25TA512B
ST25TA02KB
ST25TA02KB-D
ST25TA02KB-P
Delivery state
0x0012
1
3
1
7
2
1
Yes
Yes
Yes
Yes
Yes
Yes
Yes
None
None
None
None
None
None
ST25TA512B
ST25TA02KB
ST25TA02KB-D
ST25TA02KB-P
0x80
ST25TA512B
ST25TA02KB
ST25TA02KB-D
ST25TA02KB-P
0x00
0x000000
ST25TA512B
ST25TA02KB
0x02E4 xx xx xx xx xx
ST25TA02KB-D 0x02F3 xx xx xx xx xx
ST25TA02KB-P 0x02A3 xx xx xx xx xx (4)
ST25TA512B 0x003F
ST25TA02KB
ST25TA02KB-D
ST25TA02KB-P
0x00FF
ST25TA512B
ST25TA02KB
0xE5
0xE2
ST25TA02KB-D 0xF2
ST25TA02KB-P 0xA2
1. Configuration bytes can be locked by setting the Most significant bit to 1. Once locked, these bytes cannot be changed anymore.
2. Field detect as GPO configuration.
3. ST reserved.
4. x values are defined by ST to ensure UID uniqueness.
DS12365 - Rev 2 page 9/62
3.2
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Read and write access rights to the NDEF file
File offset
0x0003
•
•
Counter configuration lock bit:
0b0: unlocked
0b1: locked
0b00000 (ST reserved)
•
•
Counter enable:
0b0: disable
0b1: enable
•
•
Counter increment:
0b0: on Read
0b1: on Write
Table 7. Details about the Counter configuration field b7 b6-b2 b1 b0
File offset
0x0002
•
•
GPO configuration lock bit:
0b0: unlocked
0b1: locked
•
•
•
•
•
•
•
•
GPO configuration:
0b000: Not used
0b001: Session opened
0b010: WIP
0b011: MIP
0b100: Interrupt
0b101: State Control
0b110: RF Busy
0b111: Field Detect
0b0000
(ST reserved)
Table 8. Details about the GPO field b7 b6-b4 b3-b0
Read and write access rights to the NDEF file
The NDEF file can be protected for read or write accesses with passwords that the host shall present before accessing the NDEF file. There are two 128-bit passwords, one for the read access and the other one for the write access.
An NDEF file can also be locked for read or write accesses. Thus, the host cannot access the NDEF file.
The read password shall be sent to the ST25TAxxxB devices before reading a read-protected NDEF file.
The write password shall be sent to the ST25TAxxxB devices before writing a write-protected NDEF file. The write password shall be sent to change the read or write protection mode. The access rights are only relevant for the NDEF file. If the Verify command is used with the CC, System or no file selected, an error is responded by the tag.
DS12365 - Rev 2 page 10/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Read and write access rights to the NDEF file
3.2.1
Read and Write protection modes
•
•
Three protection modes are defined for each of the Read and Write access rights to the NDEF file:
• UNPROTECTED
PROTECTED
FORBIDDEN
The Read/Write protection mode is identified by the R-APDU value responded to a Verify command (see
).
Mode
READ UNPROTECTED
READ PROTECTED
READ FORBIDDEN
Table 9. Read protection modes
Verify (P1P2=0x0001) R-APDU
0x9000
0x6300
0x6984
Meaning
Read access without any security (delivery state)
Read access protected by password
Read access forbidden (permanent state)
3.2.2
Caution:
Mode
WRITE UNPROTECTED
WRITE PROTECTED
WRITE FORBIDDEN
Table 10. Write protection modes
Verify (P1P2=0x0002) R-APDU
0x9000
0x6300
0x6984
Meaning
Write access without any security (delivery state)
Write access protected by password
Write access forbidden (permanent state)
Read and Write access conditions
The CCRD and CCWR bytes (see
) in the CC file are used to identify the Read and Write access conditions for the NDEF message as defined in the NFC Forum Type 4 Tag specification. The
ST25TAxxxB support one read condition value and two write condition values.
As several protection modes may be mapped to a single condition value, the Read and Write access condition values are not to be used to identify the protection modes.
Table 11. Read access conditions (CCRD values)
0x00
Value Read protection modes
UNPROTECTED, PROTECTED, FORBIDDEN
1. Refer to Section 3.2.1 Read and Write protection modes
to discriminate between the protection modes.
Table 12. Write access conditions (CCWR values)
Value Write protection modes
0x00
0xFF
UNPROTECTED
PROTECTED, FORBIDDEN
1. Refer to Section 3.2.1 Read and Write protection modes
to discriminate between the protection modes.
DS12365 - Rev 2 page 11/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Read and write access rights to the NDEF file
3.2.3
3.2.4
Changing the read protection mode
The state diagram of Figure 8 shows how to change the read protection mode of the NDEF file.
Figure 8. Changing the read protection mode
READ UNPROTECTED
(5)
CCRD: 0x00
SW1SW2: 0x9000
Protect the
NDEF file (1)
Unprotect the
NDEF file (2)
READ PROTECTED
(4)
CCRD: 0x00
SW1SW2: 0x6300
Lock the NDEF file (3)
Lock the
NDEF file (3)
READ FORBIDDEN
(4)
CCRD: 0x00
SW1SW2: 0x6984
CCRD: byte at offset 0x000D in the CC file
SW1SW2: response to the Verify (Read protection) command
1.
See the procedure to protect the read access ( Section 7.1 Protecting an NDEF file
).
2.
See the procedure to unprotect the read access ( Section 7.3 Unprotecting an NDEF file
).
3.
See the procedure to forbid the read access (
Section 7.4 Locking an NDEF file ).
4.
Proprietary state, not defined by NFC Forum Type 4 Tag.
5.
Delivery state.
Changing the write protection mode
The state diagram of Figure 9 shows how to change the write protection mode of the NDEF file.
Figure 9. Changing the write protection mode
WRITE UNPROTECTED
(5)
CCWR: 0x00
SW1SW2: 0x9000
Protect the
NDEF file (1)
Unprotect the
NDEF file (2)
Lock the
NDEF file (3)
WRITE PROTECTED
(4)
CCWR: 0xFF
SW1SW2: 0x6300
Lock the NDEF file (3)
WRITE FORBIDDEN
CCWR: 0xFF
SW1SW2: 0x6984
CCWR: byte at offset 0x000E in the CC file
SW1SW2: response to the Verify (Write protection) command
1.
See the procedure to protect the write access (
Section 7.1 Protecting an NDEF file ).
2.
See the procedure to unprotect the write access (
Section 7.3 Unprotecting an NDEF file ).
DS12365 - Rev 2 page 12/62
3.3
3.4
Note:
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Granted access life time
3.
See the procedure to forbid the write access ( Section 7.4 Locking an NDEF file
).
4.
Proprietary state, not defined by NFC Forum Type 4 Tag.
5.
Delivery state.
Granted access life time
•
•
•
•
•
When the NDEF file is in a READ or WRITE PROTECTED state, the corresponding file access is granted starting from the first successful password presentation (see
Section 7.1 Protecting an NDEF file
), and until one of the following events occurs: an RF field shutdown a successful DESELECT command a successful NDEF Tag Application Select command (no file selected) successful Capability Container Select or System File Select command (other file selected) a wrong password presentation (security session closed)
When the NDEF file is in a READ or WRITE FORBIDDEN state, the corresponding file access is never granted.
•
•
NDEF file passwords
Two passwords are available on the ST25TAxxxB devices:
Read password: protects the read access to the NDEF file
Write password: protect the write access to the NDEF file and the setting of the read and write protection modes (see
Section 7.1 Protecting an NDEF file and Section 7.2 Accessing a protected NDEF file
)
The length of a password is 128 bits (16 bytes).
A password is presented using the Verify command (see Section 6.8.1 Verify command ).
•
•
•
•
After three consecutive authentication failures for a given password, further attempts will fail until the following sequence of events occurs: tag set in Standby power mode (RF field shutdown or DESELECT command) tag activation (anticollision and RATS commands) successful NDEF Tag Application Select command successful NDEF Select command
The delivery state for all passwords is 0x00000000000000000000000000000000.
DS12365 - Rev 2 page 13/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Specific features
4
Specific features
4.1
Caution:
4.2
Read/Write counter
A 20-bit counter can track the read or write events on the NDEF file.
It benefits from an anti-tearing mechanism, that ensures the consistency of the counter, even if there has been an electrical problem during its increment.
The value of the Read/Write counter can be checked by any application, by reading suitable bytes in System file
(see
Section 3.1.4 System file layout
).
If enabled, the Read/Write counter will be incremented on the first event (exclusively read / write) performed on the NDEF File, after a successful NDEF Tag Application Select command. Following read/write events will not modify the counter value until a new successful NDEF Tag Application Select command is issued.
•
•
The counter is reset when it is disabled.
Apart from these procedures, there is no way to act on the value of this counter.
The Read/Write counter can be configured through a specific byte in System file (see
Section 3.1.4 System file layout ).
This configuration byte allows to:
• Enable or disable this counter
Define if the counter must be incremented on a read or write sequence
Definitively lock this configuration byte
Once this configuration byte is locked, it cannot be changed anymore: the counter will behave accordingly.
If enabled, the Read/Write counter will have an impact on the execution time of the event being countered: the counter increment needs some write cycles of specific EEPROM cells automatically managed by ST25TAxxxB, this increases the total time before the response is sent to the reader.
As a consequence, an S(WTX) request can be issued on the command that will increment the counter (see
General purpose output (GPO), only available on ST25TA02KB-D/P
The GPO pad is either a CMOS pad (ST25TA02KB-P) or an open drain pad (ST25TA02KB-D).
In case of CMOS GPO active state is 1 and inactive state is 0.
•
•
•
•
•
•
•
In case of open drain an external pull-up shall be connected to it. In this case, active state is 0 and inactive state is 1. If no pull-up is used the active state is 0, but inactive state is HZ.
This pad is a configurable output signal, driven to the alternate polarity when configured event occur. Its behavior is consistent with the RF session activated and with the mode chosen by the user.
The user can select one of these configurations (
Table 68. GPO timings measurement ):
• Inactive: the state of the GPO pad is always inactive
SessionOpen: an RF session is ongoing.
MIP (NDEF Message updating In Progress): the RF host is writing an NDEF length different from 0x0000.
This mode can be used to detect when the RF host changes the NDEF message as defined by the NFC
Forum.
WIP (Writing In Progress): the ST25TA02KB-D/P is executing a writing operation.
INT (interrupt): the RF host can force the ST25TA02KB-D/P to send an alternate pulse on the GPO pin.
State mode: the RF host can control the state of the GPO pad during the RF session.
RF busy: an RF host is communicating with the ST25TA02KB-D/P.
Field detection: the RF field is sufficient to establish an RF communication with the ST25TA02KB-D/P.
GPO configuration byte can be locked, by setting its Most Significant Bit to 1 (1xxx 0000 b). Once locked, this byte cannot be changed anymore.
DS12365 - Rev 2 page 14/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.1
4.2.2
Inactive configuration (GPO field = 0x00 or 0x80)
When the GPO is configured as "Inactive", it remains in inactive state regardless of the events on the RF interface
(except setting the GPO to another configuration).
Session Open configuration (GPO field = 0x10 or 0x90)
•
•
When the GPO is configured as “Session Open”, it goes to the active state when an RF session is ongoing (see
).
An RF session is taken when the ST25TA02KB-D/P receives a valid Select Application. The session is released when:
ST25TA02KB-D/P receives a valid Deselect command
RF field becomes OFF
GPO is driven to active state after a delay ( 1.
) when the session is open.
GPO is released after a delay ( 2.
) when the session is released.
Figure 10. CMOS GPO configured as Session Open (GPO field = 0x10 or 0x90)
RF channel
GPO as
Session Open
(1)
RF Session
(2)
RF Session
1.
CmdEOFtoGPhigh (RF command End of frame to GPORF Session pad high).
2.
CmdEOFtoGPlow (RF command End of frame to GPORF Session pad low).
Figure 11. Open drain GPO configured as Session Open (GPO field = 0x10 or 0x90)
RF channel
GPO as
Session Open
(1)
RF Session
(2)
RF Session
DS12365 - Rev 2
1.
CmdEOFtoGPlow (RF command End of frame to GPORF Session pad low).
2.
CmdEOFtoGPHZ (RF command End of frame to GPORF Session pad HZ).
page 15/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.3
WIP Writing in Progress configuration (GPO field = 0x20 or 0xA0)
When the GPO is configured as “WIP”, it goes to the active state state during an RF writing operation (see
).
During an RF session, when the ST25TA02KB-D/P updates a file, the GPO is driven in active state after a delay
) following the beginning of the correspondent UpdateBinary command execution.
GPO will remain in active state during the writing time (
Figure 12. CMOS GPO configured as WIP (GPO field = 0x20 or 0xA0)
RF channel
Update command
(1)
GPO as WIP
End of writing operation
Any other command
(2)
1.
CmdEOFtoGPhigh (RF Command End of frame to GPO high).
2.
Writing time duration.
Figure 13. Open drain GPO configured as WIP (GPO field = 0x20 or 0xA0)
RF channel
Update command
(1)
GPO as WIP
End of writing operation
Any other command
(2)
1.
CmdEOFtoGPlow (RF Command End of frame to GPO low).
2.
Writing time duration.
DS12365 - Rev 2 page 16/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.4
MIP NDEF Message writing in Progress configuration (GPO field = 0x30 or 0xB0)
When the GPO is configured as MIP, its state goes to the active state when the RF host writes the NDEF length to
another value than 0x0000 (see Figure 14 or Figure 15
).
During an RF session, when the ST25TA02KB-D/P changes an NDEF file and updates the NDEF length with a value different from 0x0000, the GPO is driven in active state after a delay (
) following the beginning of the correspondent UpdateBinary command execution.
GPO will remain in active state during the writing time (
Figure 14. CMOS GPO configured as MIP (GPO field = 0x30 or 0xB0)
RF channel
Update the NDEF length ≠ 0x0000
ST25TA02KB-P response
Any other command
GPO as MIP
(1)
(2)
1.
CmdEOFtoGPhigh (RF command End of frame to GPO high).
2.
Writing time duration.
Figure 15. Open drain GPO configured as MIP (GPO field = 0x30 or 0xB0)
RF channel
GPO as MIP
Update the NDEF length != 0x0000
(1)
ST25TA02KB-D response
Any other command
(2)
1.
CmdEOFtoGPlow (RF command End of frame to GPO low).
2.
Writing time duration.
DS12365 - Rev 2 page 17/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.5
INT Interrupt configuration (GPO field = 0x40 or 0xC0)
The RF host can send a pulse on the GPO pad. The GPO pad goes to active state at the end of the command
and goes to the inactive state at the end of the ST25TA02KB-D/P response (see Figure 16
or
During an RF session, when the ST25TA02KB-D/P receives a valid SendInterrupt command, the GPO pin is
). Then the GPO pin is released at the end of the response ( 2.
).
Figure 16. CMOS GPO configured as INT (GPO field = 0x40 or 0xC0)
RF channel
Send
Interrupt
(1)
ST25TA02KB-P response
(2)
Any other operation
GPO as INT
1.
CmdEOFtoGPhigh (RF command End of frame to GPO high).
2.
RespEOFtoGPlow.
Figure 17. Open drain GPO configured as INT (GPO field = 0x40 or 0xC0)
RF channel
Send
Interrupt
ST25TA02KB-D response
Any other operation
GPO as INT
(1) (2)
DS12365 - Rev 2 page 18/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.6
State Control configuration (GPO field = 0x50 or 0xD0)
When the GPO is configured as State Control, the RF host can control the state of the GPO by sending a
dedicated command (see Figure 18
or
During an RF session, the ST25TA02KB-D/P can control the GPO pin. After receiving a valid StateControl command with Data=0x00, the GPO pin is driven in active state after a delay (
). The GPO will be released after
a valid StateControl command with Data=0x01 or after a Power off.
Figure 18. CMOS GPO configured as State Control (GPO field = 0x50 or 0xD0)
RF channel
StateControl (0x00) command
GPO as
State Control
(1)
Any other command
StateControl (0x01) command
(2)
1.
CmdEOFtoGPhigh (RF Reset GPO command End of frame to GPO high).
2.
CmdEOFtoGPlow (RF Set GPO command End of frame to GPO low).
Figure 19. Open drain GPO configured as State Control (GPO field = 0x50 or 0xD0)
RF channel
StateControl
(0x00) command
(1)
GPO as
State Control
Any other command
StateControl
(0x01) command
(2)
1.
CmdEOFtoGPlow (RF Reset GPO command End of frame to GPO low).
2.
CmdEOFtoGPHZ (RF Set GPO command End of frame to GPO HZ).
DS12365 - Rev 2 page 19/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
General purpose output (GPO), only available on ST25TA02KB-D/P
4.2.7
RF busy configuration (GPO field = 0x60 or 0xE0)
When the GPO is configured as RF busy, the GPO goes to the active state, both when the ST25TA02KB-D/P is processing an RF command or when an RF session is ongoing (see
).
When an RF field is present, the GPO is driven in active state after a delay ( 1.
) when the ST25TA02KB-D/P detects the first command. If the RF session is ongoing and the ST25TA02KB-D/P receives a not-supported
command, GPO remains active. It will be released only at the end of the RF session, after ( 2.
).
Figure 20. CMOS GPO configured as RF busy (GPO field = 0x60 or 0xE0)
RF channel (1)
RF command not supported
(2) (1)
SensReq and
SensRes
RF command
SLP_REQ or S(DES) or bad command or RF Field OFF
(2)
GPO as RF busy
1.
CmdSOFtoGPhigh (RF command Start of frame to GPO high).
2.
CmdEOFtoGPlow (RF command End of frame to GPO low).
Figure 21. Open drain GPO configured as RF busy (GPO field = 0x60 or 0xE0)
RF channel
(1) (2)
RF command not supported
(1)
SensReq and
SensRes
RF command
(2)
SLP_REQ or S(DES) or bad command or RF Field OFF
GPO as RF busy
1.
CmdSOFtoGPlow (RF command Start of frame to GPO low).
2.
CmdEOFtoGPHZ (RF command End of frame to GPO HZ).
DS12365 - Rev 2 page 20/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
TruST25™ digital signature feature
4.2.8
Field detect configuration (GPO field = 0x70 or 0xF0)
When the GPO is configured as Field detect, the GPO goes to the active state when ST25TA02KB-D/P detects
or
When an RF field is present, GPO is driven in active state after a delay when the ST25TA02KB-D/P detects this field. Whatever the activity during the RF field detection (communication with the reader or not), GPO will stay active. It will be released when the ST25TA02KB-D/P leaves the RF field.
Figure 22. CMOS GPO configured as Field detect (GPO field = 0x70 or 0xF0)
H min
RF field
GPO t
FDETON t
FDETOFF
Figure 23. Open drain GPO configured as Field detect (GPO field = 0x70 or 0xF0)
H min
RF field
V
DCG
V
SS
4.3
GPO
HZ
V
SS t
FDETON t
FDETOFF
TruST25™ digital signature feature
The ST25TAxxxB devices support the TruST25™ digital signature feature, which allows the user to verify the authenticity of the device, based on a unique digital signature.
TruST25™ solution encompasses secure industrialization processes and tools deployed by STMicroelectronics to generate, store and check the signature in the device.
Implementation details are described in application note AN5101, contact your STMicroelectronics sales office to get this document.
DS12365 - Rev 2 page 21/62
5
5.1
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Communication mechanism
Communication mechanism
This section describes the principle of communication between an RF host and the ST25TAxxxB devices.
Master and slave
The ST25TAxxxB act as slave devices on the RF channel and therefore wait for a command from the RF host before sending a response.
The RF host shall generate the RF field and the RF commands.
DS12365 - Rev 2 page 22/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
RF command sets
6
RF command sets
•
•
This section describes the ST25TAxxxB command sets that can be issued by the RF host.
There are three command families: the NFC Forum Type 4 Tag command set the ISO/IEC 7816-4 command set
• the ST-proprietary command set
The NFC Forum Type 4 Tag command set and the ISO/IEC 7816-4 command set use the
I-Block format. For more details about the I-Block format, refer to Section 6.2 I-Block format .
Two other command formats exist:
• the commands using the R-Block format
• the commands using the S-Block format
For more details about these formats, refer to Section 6.3 R-Block format
and to Section 6.4 S-Block format .
This section gives a brief description of the RF host commands. The format of these command sets is the I-Block format.
Table 13 lists the RF command sets.
Table 13. RF command sets
Family command set Command name
Class byte
Instruction code
NDEF Tag Application Select 0x00 0xA4
CC select 0x00 0xA4
Brief description
NDEF Tag Application Select
Selects the CC file
NFC Forum
Type 4 Tag
ISO/IEC 7816-4
ST-proprietary
NDEF Select
System select
ReadBinary
UpdateBinary
Verify
ChangeReferenceData 0x00 0x24
EnableVerificationRequirement 0x00 0x28
DisableVerificationRequirement 0x00 0x26
EnablePermanentState
ExtendedReadBinary
UpdateFileType
StateControl
SendInterrupt
0x00
0x00 0xA4
0x00 0xB0
0x00
0x00
0xA2
0xA2
0xA2
0xA2
0xA2
0xA4
0xD6
0x20
0x28
0xB0
0xD6
0xD6
0xD6
Selects the NDEF file
Selects the system file
Reads data from file
Writes or erases data to an NDEF file
Checks the right access of an NDEF file or sends a password
Changes a Read or Write password
Activates the password security
Disables the password security
Enables the READ FORBIDDEN or the WRITE FORBIDDEN protection mode
Reads data from file
Sets file type to NDEF or to proprietary
Drives the state of the GPO pin (1)
Generates a pulse on the GPO pin (1)
1. Available on ST25TA02KB-D/P only
DS12365 - Rev 2 page 23/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Structure of the command sets
6.1
6.2
Note:
Structure of the command sets
•
•
The exchange of data between the RF host and the ST25TAxxxB uses three kinds of data formats, called blocks:
• I-Block (Information block): to exchange the command and the response
R-Block (Receive ready block): to exchange positive or negative acknowledgment
S-Block (Supervisory block): to use either the Deselect command or the Frame Waiting eXtension (WTX) command or response
This section describes the structure of I-Block, R-block and S-Block. This format is used for the application command set.
I-Block format
The I-Block is used to exchange data between the RF host and the ST25TAxxxB. It is composed of three fields,
.
Name
Length
PCB
1 byte
PCB field
DID field (optional)
RF host to ST25TAxxxB: C-APDU
ST25TAxxxB to RF host: R-APDU
2 CRC bytes
SoD
Table 14. I-Block format
DID
1 byte
Payload
-
1 to 251 bytes
EoD
CRC
2 bytes
Table 15. PCB field of the I-Block format b7-b6
0b00
I-Block
RFU
Must be set to 0
DID field is present, if bit is set
Must be set to 0
Must be set to 1
b5
0
1. Follow ISO 14443_4 Block numbering rules (see note) b4
0 b3
X
Block numbering rules: b2
0 b1
1
Reader rules:
•
•
Rule A:The Reader block number shall be initialized to 0.
Rule B:When an I-block or an R(ACK) block with a block number equal to the current block number is received, the Reader shall toggle the current block number before optionally sending a block to the
ST25TAxxxB.
b0
X
DS12365 - Rev 2 page 24/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
I-Block format
Note:
Note:
6.2.1
ST25TAxxxB rules:
•
•
Rule C: The ST25TAxxxB block number shall be initialized to 1 at activation.
Rule D: When an I-block is received, the ST25TAxxxB shall toggle its block number before sending a block.
The ST25TAxxxB may check if the received block number is not in compliance with Reader rules to decide neither to toggle its internal block number nor to send a response block.
• Rule E: When an R(ACK) block with a block number not equal to the current ST25TAxxxB block number is received, the ST25TAxxxB shall toggle its block number before sending a block.
There is no block number toggling when an R(NAK) block is received.
When the RF host sends a command to the ST25TAxxxB, the format of the payload is the C-APDU.
When the ST25TAxxxB sends a command to the RF host, the format of the payload is the R-APDU.
C-APDU: payload format of a command
The C-APDU format is used by the RF host to send a command to the ST25TAxxxB.
format.
Table 16. C-APDU format
Name
CLA INS
Length
Class byte
- 0x00: standard command
- 0xA2: ST command
Instruction byte
1 byte 1 byte
Param Byte 1
Param Byte 2
Number of bytes of the Data field
Data bytes
Number of bytes to be read in the ST25TAxxxB memory
1. See
.
P1
1 byte
Payload field
P2
1 byte
L
C
1 byte
Data
Lc byte
Le
1 byte
DS12365 - Rev 2 page 25/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
R-Block format
6.2.2
6.3
R-APDU: payload format of a response
The ST25TAxxxB use the I-Block format to reply to a command that has used the I-Block format. This format is
.
Name
Length
Data
Status byte 1
Status byte 2
Table 17. R-APDU format
Payload field
Data (optional)
Le byte
SW1
1 byte
SW2
1 byte
R-Block format
The R-Block is used to convey positive or negative acknowledgment between the RF host and the ST25TAxxxB.
NFC frame
Length
R(ACK) without the DID field: 0xA2 or 0xA3
R(ACK) with the DID field: 0xAA or 0xAB
R(NAK) without the DID field: 0xB2 or 0xB3
R(NAK) with the DID field: 0xBA or 0xBB
DID field (optional)
-
2 CRC bytes
Table 18. R-Block format
SoD
PCB
1 byte
DID
1 byte
-
Payload
0 byte
EoD
CRC
2 bytes
There are two kinds of R-Blocks:
•
•
R(ACK): the acknowledgment block sent by the RF host or by the ST25TAxxxB
R(NAK): the non-acknowledgment block sent by the RF host
DS12365 - Rev 2 page 26/62
6.4
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
S-Block format b7-b6
0b10
R-Block
Must be set to 1.
0: ACK
1: NAK
0: DID field is not present
1: DID field is present
Must be set to 0
Must be set to 1
Block number
Table 19. PCB field of the R-Block format b5
1 b4
X b3
X b2
0
S-Block format
The S-Block is used to exchange control information between a reader and a contactless tag.
b1
1 b0
X
Table 20. S-Block format
NFC frame
Length
S(DES) without the DID field : 0xC2
S(DES) with the DID field : 0xCA
S(WTX) without the DID field : 0xF2
S(WTX) with the DID field : 0xFA
DID field (optional)
2 CRC bytes
PCB
1 byte
SoD
DID
1 byte
-
Payload
1 byte
EoD
CRC
2 bytes
There are two requests using the S-Block format:
•
•
S(DES): the Deselect command
S(WTX): the Waiting Frame eXtension command or response.
A Waiting Time eXtension request occurs in RF when the operating time needed by the ST25TAxxxB is greater than 19.2 ms.
The WTX field indicates the increase time factor to be used in this command execution (FDTtemp = WTX *
19.2 ms). WTX depends on FWI.
DS12365 - Rev 2 page 27/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
S-Block format
Note: b7-b6
0b11
S-Block
0b00: Deselect
0b11: WTX
0: DID field is not present
1: DID field is present
Must be set to 0
Must be set to 1
Must be set to 0
Table 21. PCB field of the S-Block format b5-b4
X b3
X b2
0 b1
1 b0
0
After receiving the deselect command, the ST25TAxxxB enter the Standby power mode.
In response to a RATS command, the ST25TAxxxB return the FWI parameter (default frame waiting time used); when the ST25TAxxxB need more time for a command execution, they request a frame waiting time extension by responding 0xF2 0xWTX
(Request waiting time = FWI * WTX). If the reader accepts the ST25TAxxxB request, it acknowledges the request by sending the command 0xF2 0xWTX. The frame waiting time becomes FWI * WTX for the current command only.
DS12365 - Rev 2 page 28/62
6.5
6.6
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
CRC of the RF frame
CRC of the RF frame
The two CRC bytes check the data transmission between the RF host and the ST25TAxxxB. For the RF frame, the CRC is computed on all the data bits in the frame, excluding parity bits, SOF and EOF, and the CRC itself.
The CRC is as defined in ISO/IEC 13239. The initial register content shall be 0x6363 and the register content shall not be inverted after calculation.
Status and error codes
This section lists the status and the error codes of the ST25TAxxxB.
Value 0x90
SW1
Table 22. Status code of the ST25TAxxxB
0x00
SW2
Command completed successfully
Comment
Length
Value
Value
Value
Value
Value
Value
Value
Value
Value
Value
Value
Value
Value
Value
SW1
1 byte
0x63
0x63
0x69
0x6A
0x6A
0x6A
0x6A
0x6D
0x6E
0x65
0x67
0x69
0x69
0x69
0x85
0x80
0x82
0x84
0x86
0x00
0x00
0x81
0x00
0x81
0x82
0x84
Table 23. Error codes of the ST25TAxxxB
SW2
1 byte
0x00
Comment
0xCX
Password is required
Password is incorrect, X further retries allowed
(X can take values 0, 1 or 2)
Unsuccessful updating
Wrong frame length
Command is incompatible with the file structure
Security status not satisfied
Reference data not usable
Conditions of use not satisfied
Incorrect parameters Le or Lc
File or application not found
File overflow (Lc error)
Incorrect P1 or P2 values
INS field not supported
Class not supported
DS12365 - Rev 2 page 29/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
NFC Forum Type 4 Tag protocol
6.7
6.7.1
NFC Forum Type 4 Tag protocol
The ST25TAxxxB command set is built to easily support the NFC Forum Type 4 Tag protocol.
NDEF Tag Application Select command
The RF host shall send this command to activate the NDEF Tag Application.
To activate the NDEF Tag Application, the RF host sends the Select command in addition to the sequence defined in the NFC Forum digital protocol.
Table 24 and Table 25 respectively define the C-APDU and R-APDU of the NDEF Tag Application Select
command.
Name
-
Class byte
0x00
Select instruction code
P1 field
P2 field
CLA
Number of bytes of data
Application ID
Le field
Table 24. C-APDU of the NDEF Tag Application Select command
0xA4
INS
0x04
P1
0x00
P2
0x07
Lc Data
0xD2760000850101 0x00
Le
Length
Value
Value
Value
Value
-
-
-
-
-
Data
Table 25. R-APDU of the NDEF Tag Application Select command
SW1
1 byte
0x90
0x6A
0x6D
0x6*
SW2
1 byte
0x00
0x82
0x00
0x**
Comment
-
Command completed
NDEF Tag Application not found
Class not supported
Refer to Section 6.6 Status and error codes
DS12365 - Rev 2 page 30/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
NFC Forum Type 4 Tag protocol
6.7.2
Capability Container Select command
The RF host uses the Capability Container Select procedure to select the capability container (CC) file.
The CC file is selected when this command returns "command completed" in the R-APDU.
respectively define the C-APDU and R-APDU of the Capability Container Select command.
Table 26. C-APDU of the Capability Container Select command
Name
0x00
Class byte
Select instruction code
P1 field
CLA
P2 field
Number of bytes of data
CC file ID
(empty field)
0xA4
INS
0x00
P1
0x0C
P2
0x02
Lc Data
0xE103 -
Le
6.7.3
Length
Value
Value
Value
Value -
-
-
-
-
Data
Table 27. R-APDU of the Capability Container Select command
SW1
1 byte
0x90
0x6A
0x6D
0x6*
SW2
1 byte
0x00
0x82
0x00
0x**
Comment
-
Command completed
File or application not found
Class not supported
Refer to Section 6.6 Status and error codes
NDEF Select command
The RF host uses the NDEF Select command to select the NDEF file.
The NDEF file is selected when this command returns “command completed” in the R-APDU.
Table 29 respectively define the C-APDU and R-APDU of the NDEF Select command.
Name
-
Class byte
0x00
Select instruction code
P1 field
P2 field
Number of bytes of data
0x0001: NDEF file
(empty field)
CLA
Table 28. C-APDU of the NDEF Select command
0xA4
INS
0x00
P1
0x0C
P2
0x02
Lc
0x0001
Data
-
Le
DS12365 - Rev 2 page 31/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
NFC Forum Type 4 Tag protocol
6.7.4
Length
Value
Value
Value
-
-
-
-
Data SW1
1 byte
0x90
0x6A
0x6*
Table 29. R-APDU of the NDEF Select command
SW2
1 byte
0x00
0x82
0x**
Comment
-
Command completed
File or application not found
Refer to Section 6.6 Status and error codes
System File Select command
The RF host uses this command to select the system file.
The System file is selected when this command returns "command completed" in the
R-APDU.
Table 30 and Table 31 respectively define the C-APDU and R-APDU of the System File Select command.
Name
-
Class byte
0x00
Select instruction code
P1 field
P2 field
Number of bytes of data
System file ID
(empty field)
CLA
Table 30. C-APDU of the System File Select command
0xA4
INS
0x00
P1
0x0C
P2
0x02
Lc Data
0xE101 -
Le
6.7.5
Length
Value
Value
Value -
-
-
-
Data
Table 31. R-APDU of the System File Select command
SW1
1 byte
0x90
0x6A
0x6*
SW2
1 byte
0x00
0x82
0x**
Comment
-
Command completed
System file not found, no data is returned
Refer to Section 6.6 Status and error codes
ReadBinary command
On receiving the ReadBinary command, the ST25TAxxxB read the requested memory field and send back its value in the R-APDU response.
Before sending a ReadBinary command, a file shall be selected by using a Select command.
The Response of the ReadBinary command is successful when the start offset P1P2 is lower than LEN: the length of the selected file(For more details about CC file, refer to
Section 3.1.2 CC file layout . For more details
about NDEF file, refer to Section 3.1.3 NDEF file layout
. For more details about System file, refer to
Section 3.1.4 System file layout
.)
Table 32 and Table 33 respectively define the C-APDU and R-APDU of the ReadBinary command.
DS12365 - Rev 2 page 32/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
NFC Forum Type 4 Tag protocol
Table 32. C-APDU of the ReadBinary command
Name
Class byte
-
CLA
0x00
Read instruction code
Offset in the file selected 0x0000 ≤ P1P2 < LEN
(empty field)
(empty field)
Number of bytes to read: 0x00 ≤ Le ≤ MLe
INS
0xB0
P1 and P2
2 bytes
Lc
-
Data
-
Le
1 byte
6.7.6
Length
Value
Value
Value
Value
Value
Value
Value
-
-
-
-
-
-
Data
-
Content read
Table 33. R-APDU of the ReadBinary command
SW1
1 byte
0x90
0x69
0x6A
0x69
0x6A
0x6A
0x6*
SW2
1 byte
0x00
0x85
0x80
0x82
0x82
0x86
0x**
Comment
-
Command completed
Read access forbidden
Wrong Le value (> MLe)
Security status not satisfied
File or application not found
Wrong start address (P1P2 ≥ LEN)
Refer to Section 6.6 Status and error codes
UpdateBinary command
On receiving the UpdateBinary command, the ST25TAxxxB write the data field into the selected file and send back a status in the R-APDU response. If needed, The ST25TAxxxB devices will request a timing extension (see
Before sending an UpdateBinary command, a file shall be selected by issuing a Select command.
Table 35 respectively define the C-APDU and R-APDU of the UpdateBinary command.
Table 34. C-APDU of the UpdateBinary command
Name CLA INS
-
Class byte
Write instruction code
0x00 0xD6
Offset in the file selected
Number of bytes of data (0x01 ≤ Lc≤ MLc)
Data to write in the ST25TAxxxB memory
(empty field)
P1 and P2
2 bytes
Lc
1 byte
Data
Lc bytes
Le
-
DS12365 - Rev 2 page 33/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO/IEC 7816-4 commands
6.8
6.8.1
Length
Value
Value
Value
Value
Value
Value
Value
Value -
-
-
-
-
-
-
-
-
Data SW1
1 byte
0x90
0x65
0x69
0x6A
0x69
0x6A
0x6A
0x6*
Table 35. R-APDU of the UpdateBinary command
SW2
1 byte
0x00
0x81
0x85
0x80
0x82
0x82
0x86
0x**
Comment
-
Command completed
Unsuccessful updating
Write access forbidden
Wrong Lc value (0 or > MLc)
Security status not satisfied
File or application not found
Wrong start address
Refer to Section 6.6 Status and error codes
ISO/IEC 7816-4 commands
The ISO/IEC 7816-4 command set offers some extended features such as the protection of the NDEF file. This command set is used to manage the right access of the NDEF file.
Verify command
The Verify command has two functions:
1.
Check if a password is required to access to the NDEF file (the LC field = 0x00).
2.
Check that the password embedded in the Verify command grants access to the memory (Lc field = 0x10 and the password is present).
When the Lc field equals 0x00, the verify command returns a success code (0x90 00) provided that the access to the NDEF file does not require a password. When the access to the NDEF file is protected, the tag responds the error code 0x6300 to the Verify command. When the access to the NDEF file is forbidden, the tag responds the error code 0x6984 to the Verify command.
When the Lc field equals 0x10, on receiving the Verify command, the ST25TAxxxB compare the requested password with the data contained in the request and reports whether the operation has been successful in the response.
Before sending this command, an NDEF file shall be selected by issuing the NDEF Select command. Thus, this command checks the right access condition of the last NDEF file selected.
After a successful password verification, an access is granted for the whole NDEF file.
Table 37 respectively define the C-APDU and R-APDU of the Verify command.
Table 36. C-APDU of the Verify command
Name
-
Class byte
Instruction code
CLA
0x00
INS
0x20
Password identification
0x0001: Read NDEF password transmit
0x0002: Write NDEF password transmit
Other: RFU
0x00: the password is not present
0x10: the password is present in the data field
Password
(empty field)
P1 and P2
2 bytes
Lc
1 byte
Data
Lc bytes
Le
-
DS12365 - Rev 2 page 34/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO/IEC 7816-4 commands
6.8.2
Table 37. R-APDU of the Verify command
Length -
Value -
Value -
Value -
Value -
Value -
Value -
Value -
Value -
Data SW1 SW2
1 byte 1 byte -
Comment
0x90 0x00 No password required (Lc = 0x0) or correct password (Lc = 0x10)
0x69 0x84 The conditions of use are not satisfied (e.g.the access to the NDEF file is forbidden)
0x69
0x69
0x6A
0x81
0x82
0x80
Command incompatible with file structure
Security status not satisfied
Incorrect parameter in command data field
0x63 0x00 A password is required
0x63 0xCX The password transmitted is incorrect and X encodes the number of further allowed retries
0x6* 0x** Refer to
Section 3.4 NDEF file passwords
Change Reference Data command
The Change Reference Data command replaces the read or write password related to the NDEF files previously selected. It can be performed only if the security status satisfies the security attributes for this command.
Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the reference data of theNDEF file.
Table 39 respectively define the C-APDU and R-APDU of the Change Reference Data command.
Table 38. C-APDU of the Change Reference Data command
Name
-
Class byte
0x00
CLA
0x24
INS
Instruction code
Password identification
0x0001: Read password transmit
0x0002: Write password transmit
Other: RFU
0x10: the password is present in the data field
NDEF new file Password
(empty field)
2 bytes
P1 and P2
0x10
Lc Data
Lc bytes -
Le
DS12365 - Rev 2 page 35/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO/IEC 7816-4 commands
6.8.3
Length
Value
Value
Value
Value
Value
Value
Value
Value -
-
-
-
-
-
-
-
0
Data SW1
1 byte
0x90
0x69
0x65
0x69
0x6A
0x6A
0x6A
0x6*
Table 39. R-APDU of the Change Reference Data command
SW2
1 byte
0x00
0x81
0x81
0x82
0x80
0x82
0x86
0x**
Comment
-
Command completed, the password value has been changed
Command is incompatible with the file structure
Unsuccessful updating
Security status not satisfied
Incorrect parameter in file structure
File or application not found
Incorrect P1 or P2 values
Refer to Section 6.6 Status and error codes
Enable Verification Requirement command
The Enable Verification Requirement command activates the protection by password of the NDEF file. When this command is successful, the read or write access to the NDEF file is protected by a 128-bit password. It can be performed only if the security status satisfies the security attributes for this command.
The response time of the command is ~5 ms.
Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the protection mode of the NDEF file.
Table 41 respectively define the C-APDU and R-APDU of the Enable Verification Requirement
command.
Table 40. C-APDU of the Enable Verification Requirement command
Name CLA
Class byte
-
Instruction code
0x00
New security attributes
0x0001: Enable the READ PROTECTED state
0x0002: Enable the WRITE PROTECTED state
Other: RFU
(empty field)
(empty field)
(empty field)
INS
0x28
P1 and P2
2 bytes
Lc
-
Data
-
Le
-
DS12365 - Rev 2 page 36/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO/IEC 7816-4 commands
6.8.4
Length
Value
Value
Value
Value
Value
Value
-
-
-
-
0
-
-
Data
Table 41. R-APDU of the Enable Verification Requirement command
SW1
1 byte
0x90
0x69
0x69
0x6A
0x6A
0x6*
SW2
1 byte
0x00
0x81
0x82
0x80
0x82
0x**
Comment
-
Protection mode changed to PROTECTED state
Command is incompatible with the file structure
Security status not satisfied
Incorrect parameter in command data field
File or application not found
Refer to
Section 6.6 Status and error codes
Disable Verification Requirement command
The Disable Requirement command deactivates the protection by password of the NDEF file. When this command is successful, the read or write access to the NDEF file is granted without security requirements. It can be performed only if the security status satisfies the security attributes for this command.
Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the protection mode of the NDEF file.
This response time of the command is ~6 ms.
Table 43 respectively define the C-APDU and R-APDU of the Disable Verification Requirement
command.
Table 42. C-APDU of the Disable Verification Requirement command
Name
Class byte
-
CLA
0x00
Instruction code
New security attributes
0x0001: Enable the READ UNPROTECTED state
0x0002: Enable the WRITE UNPROTECTED state
Other: RFU
(empty filed)
(empty filed)
(empty filed)
INS
0x26
P1 and P2
2 bytes
Lc
-
Data
-
Le
-
DS12365 - Rev 2 page 37/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ST-proprietary command set
6.9
6.9.1
Length
Value
Value
Value
Value
Value
Value
Value
Value -
-
-
-
-
-
0
-
-
Data
Table 43. R-APDU of the Disable Verification Requirement command
SW1
1 byte
0x90
0x69
0x69
0x6A
0x6A
0x6A
0x65
0x6*
SW2
1 byte
0x00
0x81
0x82
0x80
0x82
0x86
0x81
0x**
Comment
-
Protection mode set to UNPROTECTED state
Command is incompatible with the file structure
Security status not satisfied
CC file or System file selected
File or application not found
Incorrect P1 or P2 values
Update failed
Refer to
Section 6.6 Status and error codes
ST-proprietary command set
The RF host can be issued with the command set described in this section.
ExtendedReadBinary command
On receiving the ExtendedReadBinary command, the ST25TAxxxB read the requested memory field and send back its value in the R-APDU response.
The format and behavior of this command are identical to those of the ReadBinary command (see
shown in
Table 33. R-APDU of the ReadBinary command
for the list of return codes and definitions.
Table 44. C-APDU of the ExtendedReadBinary command
Name CLA INS
-
ST Class byte
Read instruction code
Offset in the file selected
(empty field)
(empty field)
0xA2 0xB0
Number of bytes to read between 0x00 ≤ Le ≤ MLe
P1 and P2
2 bytes
Lc
-
Data
-
Le
1 byte
6.9.2
EnablePermanentState command
This command configures the protection of the NDEF file to the READ FORBIDDEN or to the WRITE
FORBIDDEN state.
This response time of the is ~6 ms.
Table 45 and Table 46 respectively define the C-APDU and R-APDU of the EnablePermanentState command.
DS12365 - Rev 2 page 38/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ST-proprietary command set
Table 45. C-APDU of the EnablePermanentState command
Name
-
Class byte
0xA2
CLA
0x28
Instruction code
New security attributes
0x0001: Enable the READ FORBIDDEN state
0x0002: Enable the WRITE FORBIDDEN state
Other: RFU
(empty field)
(empty field)
(empty field)
INS
2 bytes
P1 and P2
-
Lc
-
Data
-
Le
6.9.3
Length
Value
Value
Value
Value
Value
Value
-
-
-
-
-
-
-
Data
Table 46. R-APDU of the EnablePermanentState command
SW1
1 byte
0x90
0x65
0x69
0x6A
0x6A
0x6*
SW2
1 byte
0x00
0x81
0x82
0x82
0x86
0x**
Comment
-
Command completed
Update failed
Security status not satisfied
File or application not found
Incorrect P1 or P2 values
Refer to Section 6.6 Status and error codes
UpdateFileType command
This command is successful only when application and file 0x0001 are selected and if the file length has previously been set to 0x0000 (message invalid) and protection modes have been set to READ UNPROTECTED and WRITE UNPROTECTED states.
The response time of the command is ~6 ms.
Table 48 respectively define the C-APDU and R-APDU of the UpdateFileType command.
Name CLA
Value
Class byte
Select instruction code
P1 field
P2 field
-
Number of bytes of data
File type
0xA2
Table 47. C-APDU of the UpdateFileType command
INS
0xD6
P1
0x00
P2
0x00
Lc
0x01
Data
1 byte
Le
-
DS12365 - Rev 2 page 39/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ST-proprietary command set
6.9.4
Length
Value
Value
Value
Value
Value
Value -
-
-
-
-
-
-
Data
Table 48. R-APDU of the UpdateFileType command
SW1
1 byte
0x90
0x69
0x6A
0x6A
0x6A
0x6*
SW2
1 byte
0x00
0x82
0x80
0x82
0x86
0x**
Comment
-
Command completed
Security status not satisfied
CC file or System file selected
File or application not found
Incorrect P1 or P2 values
Refer to Section 6.6 Status and error codes
SendInterrupt command
On receiving the SendInterrupt command, the ST25TA02KB-D or ST25TA02KB-P device generates a pulse on the GPO pin. It starts at the end of the command and ends at the end of the RF response.
Before sending this command, the system file shall be selected by issuing the System Select command.
Table 49 and Table 50 respectively define the C-APDU and R-APDU of the SendInterrupt command.
Length
Value
1 byte
CLA
0xA2
Table 49. C-APDU of the SendInterrupt command
1 byte
INS
0xD6
2 bytes
0x001E
P1 and P2
1 byte
0x00
Lc
-
-
Data
-
-
Le
6.9.5
Length
Value
Value
Value
Value
Value
-
-
-
-
-
-
Data SW1
1 byte
0x90
0x6A
0x6A
0x6A
0x6E
Table 50. R-APDU of the SendInterrupt command
SW2
1 byte
0x00
0x80
0x82
0x86
0x00
Comment
-
The interrupt has been sent
The GPO is not configured as an interrupt mode
File or application not found
Incorrect P1 or P2 values
Class not supported
StateControl command
On receiving the StateControl command with activation value 0x00, the ST25TA02KB-D or ST25TA02KB-P device drives the GPO pin to active state. On receiving the StateControl command with deactivation value 0x01, the ST25TA02KB-D or ST25TA02KB-P device releases the GPO pin that returns to inactive state.
Before sending this command, the system file shall be selected by issuing the System Select command.
Table 51 and Table 52 respectively define the C-APDU and R-APDU of the StateControl command.
DS12365 - Rev 2 page 40/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ST-proprietary command set
Length
Activation value
Deactivation value
Table 51. C-APDU of the StateControl command
CLA
1 byte
0xA2
0xA2
INS
1 byte
0xD6
0xD6
P1 and P2
2 bytes
0x001F
0x001F
Lc
1 byte
0x01
0x01
Length
Value
Value
Value
Value
Value
-
-
-
-
-
-
Data SW1
1 byte
0x90
0x6A
0x6A
0x6A
0x6E
Table 52. R-APDU of the StateControl command
SW2
1 byte
0x00
0x80
0x82
0x86
0x00
Comment
-
The set or reset has been sent
The GPO is not configured in StateControl mode
File or application not found
Incorrect P1 or P2 values
Class not supported
Data
-
0x00
0x01
-
-
-
Le
DS12365 - Rev 2 page 41/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO14443-4 / NFC-A command set
6.10
6.10.1
ISO14443-4 / NFC-A command set
This section describes the commands used to activate and deactivate the tag.
Anticollision command set
in the NFC Forum Digital Protocol specification.
Note:
Family command set
NFC-A technology
Table 53. Commands issued by the RF host
ALL_REQ
Command name
SENS_REQ
SDD_REQ
SEL_REQ
SLP_REQ
Instruction code
0x52
0x26
0x93 or 0x95
0x93 or 0x95
0x50
1. Code on 7 bits.
In response to a SDD_REQ Command with a SEL_PAR value equal to 20h, ST25TAxxxB in the Operating Field transmit the requested cascade level of their NFCID1 (NFCID1 CLn, with n = 1 or 2). The NFCID1 of
ST25TAxxxB consists of 7 bytes. The length of the Response containing a complete NFCID1 cascade level (i.e.,
NFCID1 CL1, or NFCID1 CL2) is always 5 bytes. The coding of the Response depends on the value of the
SEL_CMD byte and the size of the NFCID1.
Refer to the example below for more details.
Command
SENS_REQ or
ALL-REQ
26
52
Code
-
Table 54. Example of anticollision sequence
Comment Response
ATQA 42 00
Code Comment
UID double size bit frame anticollision
SDD_REQ 1 93 20
SEL_REQ 1
93 70 CT uid1 uid2 uid3 BBC
SDD_REQ 2 95 20
SEL_REQ 1
95 70 uid4 uid5 uid6 uid7
BBC
NVB 20
Number Valid bit
(2 bytes Code and NVB)
-
CT uid1 uid2 uid3
BCC
CT Cascade Tag “0x88”
(UID 7bytes)
BCC Block Check Character
(XOR previous Bytes)
NVB 70
(cmd NVB Uid lower bytes)
CT Cascade Tag “0x88”
NVB 20
Number Valid bit
(2 bytes Code and NVB)
-
SAK and CRC
04 DA17 uid4 uid5 uid6 uid7
BCC
NVB 70
(cmd NVB Uid Upper bytes)
SAK and CRC
20 FC70
UID not complete
(UID 7bytes)
BCC Block Check Character
(XOR previous Bytes)
UID complete
DS12365 - Rev 2 page 42/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO14443-4 / NFC-A command set
6.10.2
RATS command and ATS response
RATS command and ATS response are used for NFC Forum Type 4A Tag Platform Device Activation (as defined in NFC Forum Digital Protocol specification).
ATS response (detailed in Table 57) from the ST25TAxxxB device.
Name
Byte field
Bit field
Instruction code
FSDI
DID (0 ≤ DID ≤ 14)
2 CRC bytes
INS
0xE0
-
Table 55. RATS command
Param
1 byte b7-b4 b3-b0
CRC
2 bytes
-
The FSDI field codes the FSD that defines the maximum size that an RF host is able to receive.
the conversion from FSDI to FSD.
FSDI
FSD 16
0x0
24
0x1
32
0x2
Table 56. Conversion from FSDI to FSD
40
0x3
48
0x4
64
0x5
96
0x6 0x7
128
0x8
256 RFU
0x9-0xE 0xF
256
The DID (Dynamic ID, optionally affected to the ST25TAxxxB by the host to address ST25TAxxxB in all commands) field defines the value of the addressed ST25TAxxxB.
If DID is not ‘0’, the ST25TAxxxB ignore the command if it contains a DID different from the one affected to
ST25TAxxxB during RATS.
Name
Byte field
TL
0x05
Bit field
Length of the ATS response
FSCI = 5 → FSC = 64 bytes
-
The maximum ascending data rate is 106 kbps
The maximum descending data rate is 106 kbps
FWI field (FWI = 6 → FWT = 19.2 ms)
SFGI field (SFGI = 0 → SFGT =302 µs)
The DID is supported
2 CRC bytes
Table 57. ATS response
T0
0x75
-
TA(1)
0x80
b7-b4
TB(1)
0x60 b3-b0
TC(1)
0x02
-
CRC
2 bytes
-
DS12365 - Rev 2 page 43/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
ISO14443-4 / NFC-A command set
6.10.3
The FSCI codes the FSC which stands for the maximum frame size that the ST25TAxxxB are able to receive. The
ST25TAxxxB are able to receive up to 64 bytes of command. If the RF host sends a command with more than 64 bytes, the ST25TAxxxB will be unable to treat the command and will not reply.
The FWI which stands for the Frame Waiting time Integer codes the FWT. This time corresponds to the maximum duration while an RF host shall send before sending the next command.
The SFGI which stands for the Start-up Frame Guard Time is the minimum time that the reader shall wait after receiving the response of the ST25TAxxxB.
PPS command and response
PPS (Protocol and Parameter Selection) command and response are defined in ISO/IEC 14443-4, in the Protocol
Activation of PICC Type A.
The PPS command allows the user to change the ascending (RF host to ST25TAxxxB) and descending
(ST25TAxxxB to RF host) data rates. Usage of this command is optional, as the ST25TAxxxB devices only support 106 Kb/s in both directions.
Name
Byte field
Bit field
Description
0xDX b7-b4
INS (PPSS)
Instruction code b3-b0 -
0x11
DID
Table 58. PPS command
PPS0
PPS1 is present
PPS1
1 byte b7-b4 b3-b2
RFU
Descending data rate
(106 kbit/s) = 0b00 b1-b0
Ascending data rate
(106 kbit/s) = 0b00
The ascending and descending data rates shall be coded as described in Table 59
.
-
CRC
2 bytes
CRC
Data rate
Value
Table 59. Ascending and descending data rate coding
0b00 0b01
106 kbps RFU RFU
0b10 0b11
RFU
data rate of this response is 106 kbps.
Table 60 gives the details of the PPS response.
Byte field
Bit field
Description
6.10.4
Name
Table 60. PPS response
Response (PPSS) CRC
0xDX b7-b4
Response code b3-b0
DID field
-
2 bytes
CRC
DESELECT command
DESELECT command and response are defined in ISO/IEC 14443-4, in the Protocol Deactivation of PICC Type
A.
This command makes it possible to put the tag in Standby power mode (This state can also be reached by a shutdown of the RF field.)
It consists of an S(DES) request block (see
Section 6.4 S-Block format ) sent by the RF host and an S(DES)
response sent as acknowledge by the tag.
DS12365 - Rev 2 page 44/62
7
7.1
7.2
7.3
7.4
7.5
7.6
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Functional procedures
Functional procedures
In addition to the NDEF Detection, NDEF Read and NDEF Write procedures described in the NFC Forum Type 4
Tag specification, the ST25TAxxxB devices support the procedures described in this section to manage the protection of the NDEF file.
Protecting an NDEF file
The RF host executes this procedure to enable the read or write protection of an NDEF file. This process can be reverted by the procedure described in
Section 7.3 Unprotecting an NDEF file .
1.
Select the NDEF Tag Application
2.
Select the NDEF file
3.
Transmit the NDEF file Write password by using the Verify command
4.
Activate the protection by sending the EnableVerificationRequirement command with the adequate security
attribute (see Section 6.8.3 Enable Verification Requirement command )
Accessing a protected NDEF file
The RF host executes this procedure to access an NDEF file that has been previously protected by a password.
1.
Select the NDEF Tag Application
2.
Select the NDEF file
3.
Transmit the Read or Write password (according to the protected access) using the Verify command
4.
Access the NDEF file using the ReadBinary or the UpdateBinary command
Unprotecting an NDEF file
The RF host executes this procedure to disable the read or write access protection of an NDEF file. This process can be reverted by the procedure described in
Section 7.1 Protecting an NDEF file
.
1.
Select the NDEF Tag Application
2.
Select the NDEF file
3.
Transmit the NDEF file Write password by using the Verify command
4.
Deactivate the protection by sending the DisableVerificationRequirement command with the adequate security attribute (see
Section 6.8.4 Disable Verification Requirement command ).
Locking an NDEF file
The RF host executes this procedure to permanently permanently forbid the read or write access to an NDEF file.
Compared to the one described in
Section 7.1 Protecting an NDEF file
, this process cannot be reverted.
1.
Select the NDEF Tag Application
2.
Select the NDEF file
3.
Transmit the NDEF file Write password by using the Verify command
4.
Send an EnablePermanentState command with the adequate security attribute (see
Section 6.9.2 EnablePermanentState command )
Reaching the READ-ONLY state
The RF host executes this procedure to set the tag in the READ-ONLY state defined in the NFC T4T specification
1.
Write a non-empty NDEF message using the NDEF Write procedure from the NFC T4T specification
2.
Lock the write access using the procedure described in Section 7.4 Locking an NDEF file
Changing a password
The RF host executes this procedure to modify the read or write password used for the protection of the NDEF file
1.
Select the NDEF Tag Application
2.
Select the NDEF file
DS12365 - Rev 2 page 45/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Changing the file type
7.7
Caution:
3.
Transmit the old password value using the Verify command with the adequate security attribute (see
)
4.
Transmit the new password value using the ChangeReferenceData command with the same security
attribute (see Section 6.8.2 Change Reference Data command
)
Changing the file type
The RF host executes this procedure to change the value of the T field from the CC file
1.
Select the NDEF Tag Application
2.
Select the file 0x0001 using the NDEF Select command
3.
Unprotect all file accesses using the procedure detailed in
Section 7.3 Unprotecting an NDEF file
4.
Set the File Length to 0x0000 using the UpdateBinary command
5.
If the T field is set to a value different from 0x04, the file 0x0001 is no longer an NDEF file but a proprietary file, and the tag is in a state out of the scope of the NFC Forum.
DS12365 - Rev 2 page 46/62
8
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
UID: unique identifier
UID: unique identifier
•
•
Each ST25TAxxxB device is uniquely identified by a 7-byte unique identifier (UID). The UID is a read-only code and comprises:
• the IC manufacturer code, on 1 byte (0x02 for STMicroelectronics) the Product code, on 1 byte a device number, on 5 bytes.
Table 61 describes the UID format.
Table 61. UID format
-
IC manufacturer code
Product code
Device number
0x02 1 byte
5 bytes
1. This byte is 0xE3 for ST25TA02KB, 0xA3 for ST25TA02KB-P, 0xF3 for ST25TA02KB-D and 0xE4 for ST25TA512B.
DS12365 - Rev 2 page 47/62
9
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Maximum ratings
Maximum ratings
Stressing the devices above the ratings listed in
Table 62 may cause permanent damage to them. These are
stress ratings only and operation of the devices at these or any other conditions above those indicated in the operating sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability.
Table 62. Absolute maximum ratings
Symbol Parameter
T
A
T
STG
, h
STG
, t
STG
Ambient operating temperature
Storage conditions
T
STG
Storage temperature
Storage time
I
CC
RF supply current AC0 - AC1
V
MAX_1
V
ESD
RF input voltage amplitude between AC0 and AC1,
V
SS
pad left floating
Electrostatic discharge voltage (human body model)
Sawn wafer on UV tape
Sawn bumped wafer
(kept in its antistatic bag)
V
AC0
- V
AC1
(peak to peak) -
AC0 - AC1 -
-
Min.
-40 85
Max.
°C
Unit
-
15 25
°C months
-
Kept in its original packing form
15 25
°C months
100 mA
10
2000
V
V
1. Counted from ST shipment date.
2. Counted from ST production (taping) date.
3. Based on characterization, not tested in production. Maximum absorbed power = 100 mW at 7.5 A/m.
4. AEC-Q100-002 (compliant with JEDEC Std JESD22-A114A, C1 = 100 pF, R1 = 1500 W, R2 = 500 W).
DS12365 - Rev 2 page 48/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
GPO characteristics
10
10.1
Note:
GPO characteristics
This section summarizes the operating and measurement conditions of the GPO feature. The DC and AC characteristics are derived from tests performed under the measurement conditions summarized in the following tables. The GPO I/O is CMOS compliant.
CMOS GPO characteristics (ST25TA02KB-P only)
V
DCG
Symbol
Table 63. CMOS GPO operating conditions
GPO power supply
Parameter
1.65
Min.
5.5
Max.
V
Unit
Symbol
V
OL
V
OH
V
OL
V
OH
V
OL
V
OH
I
L_VDCG
Parameter
Output Low voltage (GPO)
Output High voltage (GPO)
Output Low voltage (GPO)
Output High voltage (GPO)
Output Low voltage (GPO)
Output High voltage (GPO)
Input leakage (V
DCG
)
Table 64. CMOS GPO DC characteristics
Test condition
I
OL
= 0.7 mA, V
DCG
= 1.65 V
I
OH
= -0.7 mA, V
DCG
= 1.65 V
I
OL
= 2 mA, V
DCG
= 2.7 V
I
OH
= -2 mA, V
DCG
= 2.7 V
I
OL
= 4 mA, V
DCG
= 5.5 V
I
OH
= -4 mA, V
DCG
= 5.5 V
V
DCG
= 1.8 V, T = 90 °C
V
DCG
= 2.7 V, T = 90 °C
V
DCG
= 5.5 V, T = 90 °C -
-
Min.
-
-
0.8 V
DCG
-
0.8 V
DCG
-
0.8 V
DCG
-
-
-
-
-
-
5
6
14
Typ.
Max.
-
0.2 V
DCG
-
0.2 V
DCG
-
0.2 V
DCG
75
100
150
Unit
V nA
Table 65. CMOS GPO AC Characteristics
Symbol Parameter Test condition Min.
Max.
Unit t t f r
(IO)
(IO) out out
Output fall time
Output rise time
CL = 50 pF, V
DCG
= 1.65 V to 5.5 V
CL = 50 pF, V
DCG
= 1.65 V to 5.5 V -
-
1. V ref(t)
output timing reference levels 0.3 V
DCG
to 0.7 V
DCG
V.
2. When GPO is set in RF Field detection mode, return to quiet position could request a longer time, depending upon
ST25TAxxxB activity (~20 ms).
3. Characterization only on bench.
ns ns
The GPO (general purpose output) can sink or source at least 0.7 mA at 1.65 V, 2 mA at 2.7 V, and 4 mA at
5.5 V.
DS12365 - Rev 2 page 49/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Open drain GPO characteristics (ST25TA02KB-D only)
10.2
Open drain GPO characteristics (ST25TA02KB-D only)
V
PULL-UP
Symbol
Table 66. Open drain GPO operating conditions
Parameter Min.
Pull-up supply 1.65
5.5
Max.
Symbol
V
OL
Parameter
Output Low voltage (GPO)
Table 67. Open drain GPO DC characteristics
Test condition
I
OL
= 1 mA,
Pull-up supply = 1.65 to 5.5 V
1. Characterized only.
V
Unit
-
Min.
Max.
0.4 V V
Unit
DS12365 - Rev 2 page 50/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
GPO parameters
11
GPO parameters
This section lists typical (characterized only) timings of the GPO according to its configuration.
Table 68. GPO timings measurement
GPO field
Session Open
WIP
Message In
Progress
Interrupt
State Control
RF Busy
Field detect
0x10 or
0x90
I/F Condition
GPO in active state when session active
RF GPO returns in inactive state
Command
NDEF select
Deselect
Symbol
CmdEOFtoGPActive
Typ. Unit
170
µs
370
0x20 or
0xA0
RF GPO in active state when programming Update Binary
CmdEOFtoGPActive
Writing time duration
(No time extension)
75
µs ms
0x30 or
0xB0
RF GPO in active state when modifying NDEF
UpdateBinary
(Msg Length #0)
UpdateBinary
Writing time duration
(No time extension)
75
0x40 or
0xC0
RF
GPO in active state after receiving an
Interrupt command
0x50 or
0xD0
RF
GPO in active state when activated
GPO returns in inactive state when deactivated
SendInterrupt
StateControl(0)
StateControl(1)
Pulse duration
0x60 or
0xE0
RF
GPO in active state after receiving an RF command
RF
GPO returns in inactive state after deselection or RF command in another protocol
0x70 or
0xF0
RF GPO in active state when RF field is present -
Anticollision command or
CmdSOFtoGPActive
Deselect or end of RF disturb
t t
FDETON
FDETOFF
75
540
60
60
6
460
140
20
µs ms
µs
µs
µs
µs
1. CmdEOFtoGPActive equals CmdEOFtoGPHigh for ST25TA02KB-P, and CmdEOFtoGPLow for
ST25TA02KB-D.
2. CmdEOFtoGPInactive equals CmdEOFtoGPLow for ST25TA02KB-P, and CmdEOFtoGPHz for
ST25TA02KB-D.
3. Writing time is a function of the message length and is automatically managed by the ST25TA02KB-D and by the ST25TA02KB-P. The NDEF message is mapped on memory blocks of 16 bytes. Each basic block has a typical update time duration of 6 ms, including the internal verify.
4. Command using another RF protocol.
5. CmdSOFtoGPActive equals CmdSOFtoGPHigh for ST25TA02KB-P, and CmdSOFtoGPLow for
ST25TA02KB-D.
DS12365 - Rev 2 page 51/62
12
Note:
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
RF electrical parameters
RF electrical parameters
This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the devices in RF mode.
The parameters in the DC and AC characteristics tables that follow are derived from tests performed under the measurement conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters.
T
A
Symbol
Table 69. Default operating conditions
Parameter
Ambient operating temperature -40
Min.
85
Max.
°C
Unit
Table 70. RF characteristics
Symbol Parameter Condition Min Typ Max Unit f
C
H_ISO t
3 t
4 t
1 t
2
H min
MI
CARRIER t
MIN
CD
W t
C
TUN
t
RF_OFF
External RF signal frequency
Operating field according to ISO
H_Extended Operating field in extended temperature range
Field detect, set-up field
100% carrier modulation index
Pause A length
Pause A low time
Pause A rise time
Pause A rise time section
Minimum time from carrier generation to first data
RF write time (including internal Verify) for one page -
RF OFF time
f
-
-
-
-
13.553 13.56
T
A
= 0°C to 50°C 1500
T
A
= -40°C to 85°C 100
-
-
T
A
= -40°C to 85°C -
MI = (A - B) / (A + B) 90
From H min
C
= 13.56 MHz
Chip reset -
-
-
28 / f
7 / f
1.5 t
0
45
C
4
C
-
-
-
-
-
-
-
50
4.468
50
1. Time between command EOF and Response SOF when updating NDEF Message Length.
2. See Capacitor value in Table 72. Ordering information scheme
3. Characterized only, at room temperature only, measured at V
AC0
-V
AC1
= 5 V peak to peak at 13.56 MHz.
-
-
13.567
7500
7500
100
40.5 / f
C t
1
16 / f
C
6 / f
C
5
55
0.1
MHz mA/m mA/m mA/m
%
µs
µs
µs
µs ms ms pF ms
•
•
•
•
•
•
All timing characterizations performed on a reference antenna with the following characteristics:
• External size: 75 mm x 48 mm
Number of turns: 4
Width of conductor: 0.5 mm
Space between two conductors: 0.5 mm
Value of the tuning capacitor: 50 pF (ST25TAxxxB)
Value of the coil: 2.5 μH
Tuning frequency: 14.2 MHz.
DS12365 - Rev 2 page 52/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Package information
13
13.1
Package information
In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK ® packages, depending on their level of environmental compliance. ECOPACK ® specifications, grade definitions and product status are available at: www.st.com.
ECOPACK ® is an ST trademark.
UFDFPN5 package information
Pin 1
Figure 24. UFDFPN5 - 5-lead, 1.7 × 1.4 mm, 0.55 mm thickness package outline
D k L
E b
E1
Pin 1 e
A
A1
Top view
(marking side)
Side view
D1
Bottom view
(pads side)
1.
Max. package warpage is 0.05 mm.
2.
Exposed copper is not systematic and can appear partially or totally according to the cross section.
3.
Drawing is not to scale.
Table 71. UFDFPN5 - 5-lead, 1.7 × 1.4 mm, 0.55 mm thickness package mechanical data
Symbol
D1
E
E1 e
L
L1 k
A
A1 b
D
-
-
millimeters
Min
0.500
0.000
0.175
1.600
1.400
1.300
0.175
0.500
Typ
0.550
-
0.200
1.700
1.500
1.400
0.200
0.400
0.550
0.100
0.400
-
-
-
Max
0.600
0.050
0.225
1.800
1.600
1.500
0.225
0.600
-
-
-
Min
0.0197
0.0000
0.0069
0.0630
0.0551
0.0512
0.0069
0.0197
-
Typ
0.0217
0.0079
0.0669
0.0591
0.0551
0.0079
0.0157
0.0217
0.0039
0.0157
1. Values in inches are converted from mm and rounded to 4 decimal digits.
2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30mm from the terminal tip.
Max
0.0236
0.0020
0.0089
0.0709
0.0630
0.0591
0.0089
-
-
-
0.0236
DS12365 - Rev 2 page 53/62
14
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Ordering information
Ordering information
Example: ST25 T
Table 72. Ordering information scheme
A 02K/512 B
Device type
ST25 = RF memory
Product type
T = Tags + RFID
Protocol
A = ISO14443-A
Memory density
02K = 2 Kbits
512 = 512 bits
Product version
B = Version B
Interface
A = None
P = P-CMOS GPO
D = Open drain GPO
Features
C= Counter
Operating temperature
6 = - 40 °C to 85 °C
Package
F = Sawn and bumped wafer, 75 ± 10 μm
G= Sawn and bumped wafer, 120 ± 10 μm
H = UFDFPN5 package (ST25TA02KB-D and ST25TA02KB-D only)
Capacitance
5 = 50 pF
-A/P/D C 6 F/G/H 5
Note: Parts marked as “ES”, “E” or accompanied by an Engineering Sample notification letter, are not yet qualified and therefore not yet ready to be used in production and any consequences deriving from such usage will not be at
ST charge. In no event, ST will be liable for any customer usage of these engineering samples in production. ST
Quality has to be contacted prior to any decision to use these Engineering samples to run qualification activity.
DS12365 - Rev 2 page 54/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Revision history
Table 73. Document revision history
Date
13-Nov-2017 1
Revision
27-Sep-2018 2
Changes
Initial release.
•
Added:
Section 4.2.1 Inactive configuration (GPO field = 0x00 or 0x80)
•
•
Updated:
Section 4.2 General purpose output (GPO), only available on ST25TA02KB-D/P
Section 4.2.2 Session Open configuration (GPO field = 0x10 or 0x90)
DS12365 - Rev 2 page 55/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Contents
Contents
Ground (VSS), only available on ST25TA02KB-P and ST25TA02KB-D. . . . . . . . . . . . . . . . . . 6
General purpose output (GPO), only available on ST25TA02KB-P and ST25TA02KB-D . . . 6
MIP NDEF Message writing in Progress configuration (GPO field = 0x30 or 0xB0). . . . . . 17
DS12365 - Rev 2 page 56/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Contents
DS12365 - Rev 2 page 57/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
Contents
DS12365 - Rev 2 page 58/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
List of tables
List of tables
DS12365 - Rev 2 page 59/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
List of tables
DS12365 - Rev 2 page 60/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
List of figures
List of figures
DS12365 - Rev 2 page 61/62
ST25TA512B, ST25TA02KB, ST25TA02KB ‑ D, ST25TA02KB ‑ P
IMPORTANT NOTICE – PLEASE READ CAREFULLY
STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgement.
Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of
Purchasers’ products.
No license, express or implied, to any intellectual property right is granted by ST herein.
Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.
ST and the ST logo are trademarks of ST. All other product or service names are the property of their respective owners.
Information in this document supersedes and replaces information previously supplied in any prior versions of this document.
© 2018 STMicroelectronics – All rights reserved
DS12365 - Rev 2 page 62/62
Atsisiųsti
Vieša nuoroda atnaujinta
Vieša nuoroda į jūsų pokalbį buvo atnaujinta. You may view and manage your chat links after registration here.
Dokumento vieša nuoroda
Reklama
