NXP Semiconductors PN544 C2 User Manual Download Page 34

Page: 34 / 172

NXP Semiconductors

UM191812

PN544 C2 User Manual

191812

All information provided in this document is subject to legal disclaimers.

User Manual

Rev. 1.2 — 2010-06-16

34 of 172

Table 12.

HCI Gate Identity Management

Gate Identity Management

Status

No specific command for this gate

Table 13.

HCI Gate Loopback

Gate Loop-Back

Status

EVT_POST_DATA

Supported (

fragmented message supported up

to 255 bytes

)

Table 14.

HCI Gate Reader A

Gate Reader A

Status

WR_XCHGDATA

Supported (

fragmented message supported up

to 260 bytes

)

EVT_READER_REQUESTED

Supported

EVT_END_OPERATION

Supported

EVT_TARGET_DISCOVERED

Supported

Table 15.

HCI Gate Reader B

Gate Reader B

Status

WR_XCHGDATA

Supported (

fragmented message supported up

to 260 bytes

)

EVT_READER_REQUESTED

Supported

EVT_END_OPERATION

Supported

EVT_TARGET_DISCOVERED

Supported

Table 16.

HCI Gate Card Emulation A

Gate Card Emulation Type A

Status

EVT_SEND_DATA

Supported in emission and reception
(

fragmented message supported up to 261

bytes

)

EVT_FIELD_ON

Supported

EVT_CARD_DEACTIVATED

Supported

EVT_CARD_ACTIVATED

Supported

Summary of Contents for PN544 C2

Page 1: ...PN544 C2 Logical Link Control Protocol Host controller interface Single Wire Protocol NFC 2 nd generation SIM centered solution Powered by the Field Abstract This is a user manual for the PN544 C2 NFC...

Page 2: ...NXP_EVT_NFC_DEACTIVATED description update Add NAD usage NfcT 0x98A3 0x997A 0x9F19 default value update registers 0x998 and 0x9931 removed trimmed value do not change Fig 47 update 1 2 2010 06 16 Upd...

Page 3: ...ule for contact less communication at 13 56 MHz The User Manual describes the software interfaces API As this document assumes pre knowledge on certain technologies please check section 4 References F...

Page 4: ...nnel CRC Cyclic Redundancy Check according to SWP specification DSR Control Line on RS232 Data Set Ready DTR Control Line on RS232 Data Terminal Ready EE EEPROM non volatile memory HCI Host Controller...

Page 5: ...memory Reg Register REJ Reject HDLC RF Radio Frequency here 13 56MHz RFU Reserved for future use RI Control Line on RS232 Ring Indicator RNR Receiver Not Ready HDLC RO Read only RR Receiver Ready HDLC...

Page 6: ...acteristics Release 7 October 2009 3 Standard ECMA 373 Near Field Communication Wired Interface NFC WI http www ecma international org 4 Standard ISO18092 Near Field Communication Interface and Protoc...

Page 7: ...544 HCI RF Protocols Wired interface to connect Secure Element NXP LLC RF Frontend Configuration 1 A high level view on the PN544 interface software structure Fig 1 System Overview The PN544 offered p...

Page 8: ...ith the PN544 by using the SPI I2 C or HSU High Speed UART serial links Only one link can be used at once and the choice is done by a hardware configuration interface mode lines IFSEL 2 0 during the p...

Page 9: ...ion begins and the edge of SCK invokes the first data sample Sampling of the data happens at the even edges 2 4 16 of the SCK clock 0 if input pin NSS goes low the outputs are enabled Sampling of the...

Page 10: ...OL The pin IFSEL0 is used to set CPHA and IFSEL1 is used to set CPOL See Table 3 for CPHA CPOL settings How to configure SPI interface SPI Interface Configuration IF0 NSS IF0 NSS IF0 NSS IF0 NSS IF0 N...

Page 11: ...of the device is set to binary 0 1 0 1 0 IF1 IF0 The prefix 0 1 0 1 0 is a fixed value inside PN544 How to configure I2 C interface I2C Interface Configuration IF0 ADDR0 IF0 NSS IF0 NSS IF0 NSS IF0 NS...

Page 12: ...it 1 bit Baud rate 115200 bauds Data order LSB first 7 NXP Logical Link Layer PN544 offers four interfaces using LLC on top of the physical layer The logical link layer of the SWP interface is accordi...

Page 13: ...es Yes Yes No No Used Lines SDA SCL IRQ MOSI MISO NSS SCK IRQ RX TX SWIO VCC The supported speeds of the interfaces are found in the PN544 Datasheet 7 7 2 Link Layer Features The link layer guarantees...

Page 14: ...al features parameters are as follows Window size is 4 can be negotiated down to 2 SREJ is not supported Retry rate is set to 10 Inter frame character timeout See 7 4 5 WARNING A minimum delay of 1 1m...

Page 15: ...e is equal to 1 except when message fragmentation is used 2 PID specifies the pipe identifier Fig 5 HCP packet The LLC layer does not provide any chaining segmentation or reassembly feature Therefore...

Page 16: ...Examples of possible usage of CB bit 1 HCI single frame without chaining Fig 6 HCI packet smaller than maximum packet size 1 The HCI component splits up the content into two different LLC frames There...

Page 17: ...y upper layer information and some control information I frame functions include sequencing flow control and error detection and recovery I frames carry send and receive sequence numbers S Frames Supe...

Page 18: ...information transfer or error recovery Frames with the S format control field do not contain an information field Supervisory Format commands and responses are as follows RR Receive Ready is used by a...

Page 19: ...equence number variables in the both endpoints UA Unnumbered Acknowledgment is used to acknowledge the receipt and acceptance of a RSET command Table 8 modifier coding of the U Frames Frames modifier...

Page 20: ...2010 06 16 20 of 172 1 U RSET frame with 115200 baud rate for HSU Fig 10 LLC RSET frame example Another example of complete LLC frame 1 U RSET frame without HSU baud rate setup Fig 11 Recommended RSE...

Page 21: ...er identifies the baud rate used for the HSU interface The frame on the host side looks now as follows 1 2 nnnn nnnn 4 2 0 pppp pppp 9 3 Endpoint capabilities are not used in host direction Fig 12 Bau...

Page 22: ...tional HSU baud rate 0x00 9 600 baud 0x01 RFU 0x02 28 800 baud 0x03 RFU 0x04 RFU 0x05 115 200 baud 0x06 230 400 baud 0x07 460 800 baud 0x08 RFU A baud rate change is always initiated by the host The f...

Page 23: ...tection of errors in a frame is based on the standard CRC 16 defined in 2 The CRC polynomial is X16 X12 X5 1 Its initial value is 0xFFFF The CRC is computed on the bits between SOF and EOF both exclud...

Page 24: ...value of TIC can be configured in EEPROM If not needed TIC detection can be disabled The TIC is mainly used to trigger the communication between the host and the device It is used with I2C and SPI ho...

Page 25: ...se Communication OK After sending a frame to the host PN544 starts an internal timer waiting for the frame to be acknowledged by the host The ACK is received in time and PN544 will proceed sending the...

Page 26: ...e of a single frame is 33 Bytes Considering the header offset 29 bytes remain for HCI This is the same frame length as for the SWP interface if the LEN byte is not counted Note A special attention is...

Page 27: ...N544 to Host 7 4 6 3 Example Full Duplex Transfer PN544 is capable of receiving and transmitting frames at the same time The host shall be able to handle this situation as well The frames shall be con...

Page 28: ...clock select the PN544 and set the direction bit to Read from the host point of view The IRQ management is not mandatory on host side host can manage I2 C by polling as well Supported I2 C addresses A...

Page 29: ...a turned out to be for some reason irrelevant the chip shall transmit bytes containing the value 0xFF h until the clock has been turned off A R LEN H BLEN B1 Regular Frame Transfer PN544 Host PN544 re...

Page 30: ...ted which indicates pending data on the PN544 The bits are conveyed using most significant bit most significant byte first The interface can be used in full duplex mode These SPI relevant settings are...

Page 31: ...m Slave to Master PN544 to Host The PN544 will set to high the IRQ line The host shall now apply the clock and toggle NSS as long as no data is pending any more This can be observed by either processi...

Page 32: ...r channel is conveying a non zero value As soon as a byte is arriving which has a value greater than 0 it shall be handled as a regular frame and shall therefore handle this byte as length information...

Page 33: ...Commands Events Supported To have more details on commands events please refer to the HCI specification 1 Table 9 HCI All Gates All Gates Status ANY_SET_PARAMETER Supported on all pipes ANY_GET_PARAM...

Page 34: ...e Reader A Gate Reader A Status WR_XCHGDATA Supported fragmented message supported up to 260 bytes EVT_READER_REQUESTED Supported EVT_END_OPERATION Supported EVT_TARGET_DISCOVERED Supported Table 15 H...

Page 35: ...Type B Status EVT_SEND_DATA Supported in emission and reception fragmented message supported up to 255 data bytes EVT_FIELD_ON Supported EVT_CARD_DEACTIVATED Supported EVT_CARD_ACTIVATED Supported EV...

Page 36: ...e 19 HCI Gate Administration Gate Administration Status SESSION_IDENTITY Supported MAX_PIPE Supported WHITELIST Supported HOSTS_LIST Supported Table 20 HCI Gate Link Management Gate Link Manager Servi...

Page 37: ...APPLICATION_DATA Supported SAK Supported FWI SFGT Supported DATARATE_MAX Supported Table 24 HCI Gate Reader B Gate Reader B Status PUPI Supported APPLICATION_DATA Supported AFI Supported HIGHER_LAYER_...

Page 38: ...bject to legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 38 of 172 Table 26 HCI Gate Emulation B Gate Card Emulation Type B Status MODE Supported PUPI Supported AFI S...

Page 39: ...is the memory location to which the parameter is written REG Register volatile memory Values are written to a memory which does not have any limitation with respect to write cycles It is valid until a...

Page 40: ...communication channel has to be created between the different host gates 9 2 2 Pipe ID allocation PN544 allocates pipe IDs according to the following rules Pipe IDs related to pipes created between PN...

Page 41: ...2010 All rights reserved User Manual Rev 1 2 2010 06 16 41 of 172 RF configuration Card RF gate RF Reader Gates From NXP HCI proprietary System management SWP Polling Loop NFC WI MIFARE Reader Integr...

Page 42: ...0x13 ANY_OPEN_PIPE ADM Gate ADM Gate Type A Reader Gate Type A Reader Gate ANY_OK PipeID ADM Gate ADM Gate ANY_OK Type A Reader Gate Type A Reader Gate HOST must save the PipeID returned by PN544 for...

Page 43: ...0x13 ANY_OPEN_PIPE ADM Gate ADM Gate Type A Reader Gate Type A Reader Gate ANY_OK PipeID ADM Gate ADM Gate ANY_OK Type A Reader Gate Type A Reader Gate Administration Gate Pipe Open RF Reader Type A P...

Page 44: ...ization process to the First time setup 9 2 4 After First Setup Default state After an initial configuration of the PN544 there is no further need to perform the same level of configuration on subsequ...

Page 45: ...is chapter describes the System Management of PN544 The host could manage the management of the system through a dedicated gate PN544Mgt Table 27 PN544 System Management Gate Gate GID PN544Mgt gate 90...

Page 46: ...PN544 configuration EEDATA HW registers via Read Write commands Perform self tests Table 28 Self test commands Value Command Description 20 NXP_SELF_TEST_ANTENNA Perform antenna self test 21 NXP_SELF...

Page 47: ...eter is optional in case it is not set in the command the latest set values are used to perform the test default values are 0x05 0x05 0x04 0x09 The response to the NXP_SELF_TEST_ANTENNA command is as...

Page 48: ...nt 0x01 PmuVcc present Note Pay attention that to make the detection working PmuVcc must be present when PN544 is booting Table 32 Type Approval Test commands Value Command Description 25 NXP_PRBS_TES...

Page 49: ...t Value Event Description 01 NXP_EVT_SET_AUTONOMOUS This event is sent by the host to put the system in Autonomous mode Note This event is interesting to inform PN544 when Host keep PVDD available and...

Page 50: ...PN544 reboot 14 NXP_EVT_INFO_TEMP_OVERHEAT This event is sent to the host to inform about temperature overheat This issue is triggering the internal protection mode 15 NXP_EVT_INFO_LLC_ERR This event...

Page 51: ...icates no RF field present 0x01 indicates RF field present The NXP_EVT_INFO_TEMP_OVERHEAT event has the following parameter Table 40 TEMP_OVERHEAT Event Description Length Status 1 Status indicates ab...

Page 52: ...ss to be read The response to the NXP_READ command is as follows Table 43 Read Command Response Description Length Value 1 Value contain the memory read value The NXP_WRITE command has the following p...

Page 53: ...t 1 PmuVcc switch 2 External RF field 3 Memory violation 4 4 Temperature overheat 5 LLC Error Counter reached on UICC 6 7 RFU 0x0 do not notify 0x1 notify 1 0x00 03 NXP_INFO_EEPROM_ERR RO RAM Indicate...

Page 54: ...ch can be set by the PWR_STATUS EEPROM area 2 modes are available ActiveBAT or Standby ActiveBAT mode means that the PN544 is kept awake default mode Standby mode is the PN544 low power mode this is t...

Page 55: ...ansmit time T2 T1 1ms 6 T3 Inactivity time T3 1s Fig 31 PN544 Host Link wake up Step1 When receiving a frame on host link PN544 can switch from Standby mode to ActiveBAT mode In case of T1 timeout mea...

Page 56: ...ost will be notified with the following events NXP_EVT_INFO_TXLDO_OVERCUR NXP_EVT_INFO_PMUVCC or NXP_EVT_INFO_EXT_RF_FIELD 9 3 4 Default Secured Element in Power by the Field mode When PN544 is in Pow...

Page 57: ...the way to give back acknowledge to PN544 To setup the Clock some EEPROM data have to be set PlClockRequest PlClockAck PlClockTimeout FRAC_ClkSel and FRAC4_xxx The PollingLoopMgt gate has to be used t...

Page 58: ...the system FRAC4_DIV FRAC4_OOF0 FRAC4_OOF1 FRAC4_OOF2 FRAC4_CAL0 FRAC4_CAL1 6 Registers values Registers values correspond to the input clock frequency provided by the system To setup only if FRAC_Cl...

Page 59: ...06 16 59 of 172 9 4 2 1 Clock Request using GPIO pin The following figures show the 2 possible use of GPIO pin for Clock Request GPIO2 acknowledge GPIO1 CLKREQ System Clock 1 CLKACK 1 Fig 32 Clock req...

Page 60: ...for Clock Request acknowledge 1 3 2 1 Fig 34 Clock request with HCI Event acknowledge with HCI Event 1 3 2 1 Fig 35 Clock request with HCI Event acknowledge with Timeout Note Step2 means that system...

Page 61: ...ter Table 52 Setting for no clock request Name Length bytes Value s Comments PlClockRequest 1 0 System clock always available Note No others settings are required for this configuration It means that...

Page 62: ...t to PN544 is detailed in the clock acknowledge chapter Step2 As soon as the PN544 does not need the system clock it puts the CLKREQ level to low Then system can disable the clock 9 4 3 3 Request thro...

Page 63: ...em clock it sends the HCI event NXP_EVT_CLK_REQUEST with status byte set to 0x01 for Clock release to the Host controller Then system can disable the clock 9 4 4 Clock Acknowledge There are 3 ways to...

Page 64: ...rom the system for clock request see previous chapter Clock Request Release Fig 33 Fig 35 Step2 When the configured timeout occurs PN544 is ensured to have the system clock available 9 4 4 2 Acknowled...

Page 65: ...lock request see previous chapter Clock Request Release Step2 When the system clock is available CLKACK pin goes high PN544 is informed that clock is available stable Step3 When the system clock is no...

Page 66: ...ystem Clock 1 NXP_EVT_CLK_ACK 2 1 Fig 40 Clock acknowledge with HCI event Step1 PN544 request the clock from the system for clock request see previous chapter Clock Request Release Step2 When the syst...

Page 67: ...1 NFC CLK request in NFC active target mode Initiator expects response after Std ATR guardtime Initiator T T T T TGuardtime is equal or greater 5ms according ISO specification TSTD is between 57us and...

Page 68: ...Get information on SWP link status Table 59 SWP Events Value Event Description 03 NXP_EVT_SWP_SWITCH_MODE This event is sent by the host to temporary activate deactivate SWP link Warning PN544 cannot...

Page 69: ...nk has to be enabled when required only when external field is present 0x00 Off never activated 0x01 On activated when required Others values are RFU 1 0x00 02 NXP_SWP_STATUS RO RAM 5 Indicates the cu...

Page 70: ...0x00 Disabled 10 0x01 Enabled Others values are RFU 1 0x00 Information of a transaction occurs with an application located in the UICC is shared through the ETSI HCI standard 1 triggering proactivity...

Page 71: ...the baudrate The default baud rate used is 848 kbit s It may be changed by setting the SWP_Bitrate EEPROM area See SWP configuration chapter 9 5 1 4 Powering the UICC when Vbat Vbat critical By defaul...

Page 72: ...status SWP status can be read using NXP_SWP_STATUS Id 02 of the registry See Fig 42 for SWP state transition 9 5 2 Examples of communication with the UICC connected via SWP 9 5 2 1 Card emulation use...

Page 73: ...r Manual 191812 All information provided in this document is subject to legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 73 of 172 UICC Type A Card Emulation Example F...

Page 74: ...2010 06 16 74 of 172 9 5 2 2 Reader use case The host shall set the parameters of the SwpMgt gate as described in the previous paragraph The UICC shall behave as described in HCI specification The UI...

Page 75: ...4 C2 User Manual 191812 All information provided in this document is subject to legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 75 of 172 UICC Reader Type A Example F...

Page 76: ...CARD_ACTIVATED EVT_SEND_DATA EVT_SEND_DATA EVT_CARD_DEACTIVATED EVT_FIELD_OFF Can be repeated Card RF Gate Card RF Gate Card RF Gate Card RF Gate Card RF Gate Card RF Gate Card Gate Card Gate Card Gat...

Page 77: ...PAYPASS Id Name Access Right Comment Length Recommended Value 09 DATARATE_MAX RW Maximum data rate supported Restrict to 106 Baud rate 3 0x00 00 01 06 FWI RW Frame waiting time as defined in ISO IEC 1...

Page 78: ...01 NXP_EVT_CLK_ACK This event is sent by the host to acknowledge the clock request if PlClockAck EEPROM area has been previously set to 2 02 NXP_EVT_CLK_REQUEST This event is sent to the host to info...

Page 79: ...tus values Value Description 0x00 Clock request 0x01 Clock release Others RFU The NXP_EVT_ACTIVATE_RDPHASE event has parameters as follows Table 69 NXP_EVT_ACTIVATE_RDPHASE Event Parameters Descriptio...

Page 80: ...12 3 Detection type F 424 4 Detection ISO15693 5 Detection NFC active 6 RFU 7 Detection Pause 0 disabled 1 enabled When Pause phase is enabled it implicitly replaces the Emulation phase setting NXP_PL...

Page 81: ...r Manual Rev 1 2 2010 06 16 81 of 172 9 6 1 Clock Refer to Clock Management 9 4 paragraph for details It includes an explanation on the usage of the events NXP_EVT_CLK_ACK NXP_EVT_CLK_REQUEST And an e...

Page 82: ...ATUS EEPROM area value It waits for a command from the host or from an external reader if the RF level detector has been enabled in that case Refer to SWP NFC WI setup It stays infinitely in this stat...

Page 83: ...10 06 16 83 of 172 9 6 2 1 Detection Guard Time Polling Loop timings for detection are set as follows 1 Fig 47 Polling Loop Timings All Guard Times are set with respect to the technology specification...

Page 84: ...next phase of Polling Loop This timeout value can be changed by setting the NFCI_ATR_TOMSB LSB EEPROM area See HW configuration chapter 9 6 2 3 Activation Timeout for ISO14443 PICC NFC IP1 Target ISO1...

Page 85: ...as an NFC IP1 Initiator Detection type B set to 1 this bit allows the host to behave as an ISO14443B reader The method used is the probabilistic approach Detection type F 212 424 set to 1 these bits...

Page 86: ...ns no action PN544 does not perform any action Note Refer to PWR_STATUS See 0 chapter to set the default power mode of Emulation or Pause phases Reader Phase Card Emulation Phase Duration set by NXP_P...

Page 87: ...Note From a functional point of view this mode is equivalent to the previous mode No phase started One Pause phase only If only a Pause phase is enabled PN544 can stay in an inactive mode no Reader a...

Page 88: ...EADER_REQUESTED Polling Loop Gate Polling Loop Gate NXP_PL_PAUSE Pause Phase Duration 0x1046 200 ms 1 Fig 51 Reader Phase only In this example the host wants to act as an ISO14443A reader After correc...

Page 89: ...XP_PL_PAUSE Pause Phase Duration 0x1046 200 ms Detection Type B Detection Type F 1 Fig 52 Several Reader Phases Note it is assumed that the RF Gate initialization has been performed It means that to l...

Page 90: ...e Polling Loop Gate Polling Loop Gate EVT_TARGET_DISCOVERED Type A Reader Gate Type A Reader Gate Mandatory Optional For Information 1 Note In this example there is no reader activated on Host side EV...

Page 91: ...inform the host by sending a NXP_EVT_DEACTIVATE_RDPHASE The host can decide to stop the reader request by sending NXP_PL_RDPHASES and disable the RF technology detection HOST PN544 NXP_EVT_DEACTIVATE_...

Page 92: ...172 9 6 3 Example of Polling Loop Here is an example of Polling Loop launch with an ISO14443 type A card detected 2 Fig 56 Polling Loop with ISO14443 Type A card detected Notes If the Host wants to re...

Page 93: ...ti Secure Element In the case of Card Emulation over SWP UICC and NFC WI enable PN544 cannot present multiple cards to the external PCD It is up to the host to manage the Secure Element enabled At app...

Page 94: ...ype B 212kbps and 424kbps Passive Initiator and Active Initiator Target When TVDD is not configured to 2 7V for VBAT higher than TVDD configured 0 5V when TXLDO offset is used TVDD configured otherwis...

Page 95: ...over NFC WI Table 73 NFC WI Events Value Event Description 01 NXP_EVT_SE_START_OF_TRANSACTION This event is sent to the host to inform that a transaction starts 02 NXP_EVT_SE_END_OF_TRANSACTION This...

Page 96: ...TMODE registry Table 76 NFC WI Registry Id Name Access Rights Comment Length Default 01 NXP_SE_DEFAULTMODE RW EE Indicates the default mode of the SE connected over NFC WI 0 Off mode 1 Virtual mode Ot...

Page 97: ...r from an external PCD Fig 59 NFC WI Off Mode Wired mode is used to communicate with the Secure Element internally No RF field is emitted In this mode PN544 acts as PCD to access to the Secure Element...

Page 98: ...l mode Secure Element is seen as a real contact less card PCD NFC WI application NFC WI application gate Secure Element I2C or SPI or HSU HOST NFC WI PN544 antenna NFC WI Virtual mode NFC WI RF Techno...

Page 99: ...mmand Description 20 NXP_MIFARE_RAW This command allows the exchange of raw data between the host and a MIFARE card previously activated Within this command and response the CRC has to be handled by t...

Page 100: ...byte value 0 indicates all are valid from 1 to 7 it indicated the number of valid bits other bits are RFU Data is the raw frame received from the card including CRC 9 8 2 NXP_MIFARE Commands and Regis...

Page 101: ...d sector 8 0xA8 Write sector9 others RFU Addr is the address associated with the MIFARE command Data is an array containing either the data to be sent to the card during a writing operation or the dat...

Page 102: ...0 WR_RF_ERROR the target has returned an RF error Data is an array containing data read from the card in case of a reading command Table 85 MIFARE Authenticate Command Value Command Description 22 NXP...

Page 103: ...code possible values any of the ETSI HCI generic response code Table 89 MIFARE Command Value Command Description 12 NXP_WRA_CONTINUE_ACTIVATION The host sends this command to inform the CLF Controller...

Page 104: ...y commands see NXP_MIFARE_RAW and NXP_MIFARE_CMD or to activate the remote card up to ISO14443 4 level RATS and PPS using command NXP_WRA_CONTINUE_ACTIVATION If set to 1 activation follows the flow de...

Page 105: ...tal READER phase Clock needed Clock request or crystal External ISO14443A MIFARE card in the field Initialization anticollision and activation i e for ISO14443A REQA anticol SELECT Type A RF Reader Ga...

Page 106: ...2 2010 06 16 106 of 172 Examples for a MIFARE 1K all values are in hex Authentication example 60 02 E2 3F B8 1E FF FF FF FF FF FF authenticate using the keys FF FF FF FF FF FF value by default for a n...

Page 107: ...specifications Activation sequence is done without any filtering Polling request is performed with SYSTEM_CODE field set to 0xFFFF Then the activated FeliCa card can be accessed through the following...

Page 108: ...d the number of valid bits Data is the raw frame received from the card Note As FeliCa operates with full bytes Status byte of NXP_FELICA_RAW command value should be 0x00 Table 96 NXP_FELICA_CMD Comma...

Page 109: ...sponse to this command is as follows Table 99 FeliCa Command Response Description Length Data N Data is an array containing the data to be sent within the response as follows Check response Status Fla...

Page 110: ...ED EVT_END_OPERATION EVT_TARGET_ACTIVATED described in the Reader RF gates and Reader Gates of ETSI HCI specifications Then the activated Jewel Topaz card can be accessed through the following NXP pro...

Page 111: ...ddress Byte 2 9 0x00 Byte 9 12 card ID 0x53 Write1E Byte 1 address Byte 2 data to write Byte 3 6 card ID 0x54 Write4E Byte 1 address Byte 2 5 data to write Byte 6 9 card ID 0x55 Write8E Byte 1 address...

Page 112: ...dALL Byte 1 2 0x00 Byte 3 6 card ID 0x01 Read1 Byte 1 address Byte 2 0x00 Byte 3 6 card ID 0x02 Read8 Byte 1 address Byte 2 9 0x00 Byte 9 12 card ID 0x53 Write1E Byte 1 address Byte 2 data to write By...

Page 113: ...ISO15693 PN544 offers ISO15693 reader functionality through the generic Reader RF gates features of the ETSI HCI specification This is done with the following proprietary gate Table 107 ISO15693 reade...

Page 114: ...ification Flags Command code Parameters Data The response to the NXP_ISO15693_CMD command is as follows Table 110 Reader ISO15693 Command Response Description Length Payload N Payload defines general...

Page 115: ...a DEP_RES information PFB 02 NXP_EVT_NFC_ACTIVATED This event is sent to the host to notify that NFCIP 1 protocol has been activated Meaning that in initiator mode it has activated a remote NFC target...

Page 116: ...ameter Table 114 NFCIP 1 Activated Event Description Length Mode 1 Mode indicates in which mode the current activation as be done 0x00 Passive mode 0x01 Active The NXP_EVT_NFC_SND_DATA event has the f...

Page 117: ...6 16 117 of 172 Value Description 0x01 RF error others RFU MI indicates Multiple Information chaining information activated if set to 1 Data which are received from the peer in case of RF error data l...

Page 118: ...DATA and receiving event NXP_EVT_NFC_RCV_DATA The host can close the communication with remote peer by sending ETSI HCI generic event EVT_END_OPERATION External NFC IP1 Target Initialization anticolli...

Page 119: ...C IP1 Initiator Gate Send the data in NFC IP1 protocol NFC IP1 Initiator Gate NFC IP1 Initiator Gate NXP_EVT_NFC_SND_DATA MI 0 Fig 64 NFC IP1 Initiator exchange using NXP_EVT_NFC_CONTINUE_MI Note When...

Page 120: ..._TARGET_DISCOVERED will be sent to the Type A Reader application gate even if the remote target is an NFC device Type F In case a pipe has been opened on the Type F Reader RF gate the activation proce...

Page 121: ...44 Initialization NFC IP1 Reader TypeA NFC IP1 Initiator TypeA Reader Type A Reader Gate Type A Reader Gate EVT_TARGET_DISCOVERED Type A Reader Gate ANY_GET_PARAMETER SAK NXP_EVT_NFC_RCV_DATA NFC IP1...

Page 122: ...This value shall be interpreted as a bit mask Bit Mode 0 106kbit s passive 1 212kbit s passive 2 424kbit s passive 3 106kbit s active 4 212kbit s active 5 424kbit s active 6 7 RFU 0 not supported 1 s...

Page 123: ...bit rates have to be changed for DEP exchanges PSL command to be used or not 0x0 bit rates remain unchanged from bit rate used for activation 0x1 bit rates to be changed according to other bits config...

Page 124: ...rameters of the NFCIP 1 link when communication has been set bits 0 to 2 datarate Target to Initiator bits 3 to 5 datarate Initiator to Target 0 Divisor equal to 1 1 Divisor equal to 2 2 Divisor equal...

Page 125: ...handled in the PN544 the host receives the proprietary event NXP_EVT_NFC_ACTIVATED Then the host can exchange data with the remote peer receiving event NXP_EVT_NFC_RCV_DATA and using event NXP_EVT_NF...

Page 126: ..._DATA NFC IP1 Target NXP_EVT_NFC_SND_DATA MI 1 NFC IP1 Target Gate NFC IP1 Target Gate NFC IP1 Target Gate NFC IP1 Target Gate NFC IP1 Target Gate NFC IP1 Target Gate NXP_EVT_NFC_CONTINUE_MI NXP_EVT_N...

Page 127: ...ve 2 424kbit s passive 3 Active 4 7 RFU 0 not supported 1 supported 1 0x00 02 NXP_NFCT_ATR_REQ RO RAM Contains the General Bytes of the ATR_REQ max size is 48 bytes N N 0 03 NXP_NFCT_ATR_RES RW EE Con...

Page 128: ...cation has been set bits 0 to 2 datarate Target to Initiator bits 3 to 5 datarate Initiator to Target 0 Divisor equal to 1 1 Divisor equal to 2 2 Divisor equal to 4 Other values RFU bits 6 to 7 maximu...

Page 129: ...to this command indicates the result of the activation procedure of next card when the response is sent next remote card has been activated Parameter in the response indicates if there is still other...

Page 130: ...Description Value Description 0x00 Single target in the field 0x03 Several targets in the field The NXP_WR_ACTIVATE_ID command has the following parameters Table 124 NXP_WR_ACTIVATE_ID Command Descrip...

Page 131: ...e UICC is not interested in such card Table 127 Reader RF Additional Event Value Event Description 35 NXP_EVT_RELEASE_TARGET This event allows the host to release the current activated target as it is...

Page 132: ...SPI HSU host as a Type A card The Type A card emulation can be located in the host connected to PN544 over I2C SPI or HSU link The host is not allowed to transmit a UID The UID in that case is a singl...

Page 133: ...r host link I2C SPI HSU Host as a Type A reader The host processor can run a Type A reader application as described in HCI specification Refer to paragraph Polling Loop host reader example 9 15 3 Mean...

Page 134: ...er Gate Type A RF Reader Gate External ISO14443A card in the field ATQA SDD SELECT SELECT response RATS ATS REQA ATQA SDD SELECT SELECT response RATS ATS NXP_WR_ACTIVATE_NEXT Response parameter STATUS...

Page 135: ...n provided in this document is subject to legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 135 of 172 To reactivate a chosen card its UID is used in NXP_WR_ACTIVATE_ID...

Page 136: ...nd NXP_WR_PRESCHECK In ISO14443 the PN544 will send a R NAK block to the card It expect R ACK or last I block in response as defined in ISO14443 4 9 15 4 Handling of multiple Type A readers Both the U...

Page 137: ...READ WRITE SwpMgt_Request_Power to choose the pin used to request power NXP_READ WRITE SWP_Bitrate to change the baudrate on SWP NXP_SWP_RIGHTS_RD to allow UICC type A reader mode NXP_SWP_STATUS to ch...

Page 138: ...UM191812 PN544 C2 User Manual 191812 All information provided in this document is subject to legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 138 of 172 Fig 73 Communi...

Page 139: ...in that case is randomly generated by the PN544 9 16 3 Multiple Type B PICC PN544 cannot emulate two type B cards at the same time It is not possible to emulate at the time a Type B card in the UICC a...

Page 140: ...specification The method used is fixed in ROM The method used is the probabilistic approach 9 16 6 Meaning of additional commands of Reader RF gates for Type B Refer to Reader RF gates additional com...

Page 141: ...nowledge by pin is used or Power request when Power request is used see chapter Request through CLKREQ pin and parameter SwpMgt_Request_Power in chapter SWP configuration GPIO3 is Power request when P...

Page 142: ...the other GPIO configuration it is advised to first read the PDIR byte to apply then a new value which changes only the desired bit 9 17 3 2 Read write an output pin To set with immediate effect GPIO...

Page 143: ...change the other GPIO configuration it is advised to first read the PDIR and PEN bytes to apply then new values which change only the desired bit 9 17 3 4 Read an input pin write is not possible To re...

Page 144: ...fic protocol different from LLC HCI described in 8 The only way to leave the Download mode is to perform a reset through download mode reset command or HW reset 9 18 1 Switch in Download mode To switc...

Page 145: ...2010 06 16 145 of 172 Fig 74 Switch to Download mode Note WRITE READ CHECK RESET command are part of the Download protocol documented in the dedicated Application Note 8 WRITE command is mandatory to...

Page 146: ...and setting EEPROM Data area See 0 chapter the following debug mode can be used 9 19 1 SWP digitized To allow outputting SWP RX signal digitized to GPIO7 the following actions are needed 1 Set ANAIRQ...

Page 147: ...RF detected 0 No RF detected For further details on this signal refer to 11 7 To disable this setup 1 Perform a Hardware Reset VEN pin use 2 Set GPIO7 direction to its default configuration depending...

Page 148: ...legal disclaimers NXP B V 2010 All rights reserved User Manual Rev 1 2 2010 06 16 148 of 172 2 Set Debug_Interface to 0x01 For further details on this signal refer to 11 To disable this setup 1 Perfor...

Page 149: ...C to be OK for each frame received Bit3 if equal to 1 the RNR will be sent after ClearAllPipe command and other long processing command instead of RR Bit4 if equal to 1 the soft reset in case of too m...

Page 150: ...ivity to detect Low RF field 0x07 Minimum sensitivity 0x05 0x9ED7 UICC_GateList Registry entry related to the Gate list IdentityManagement gate of the Uicc Can be used to define UICC rights For exampl...

Page 151: ...e UICC 0x13 0x9C03 SWP_SyncID1 0x13 0x9EA2 UICC_AdminSessionId Registry entry related to SessionIdentity Administration gate of the UICC Can be used to force UICC to re create its context 0xFF 0x9EA3...

Page 152: ...to SigOut when in virtual mode in wired mode this parameter is fixed to 0x02 TX envelope 0x00 Low 0x01 High 0x02 TX envelope 0x03 MILLER enveloppe ISO14443A 106kbit s 0x04 MANCHESTER envelope FeliCa 0...

Page 153: ...1 Bit 4 RFU keep unchanged Bit 5 Enable TX LDO limiter if set to 1 CLOCK configuration Bit 7 0 Use internal FracNPLL for clock generation 1 Use external crystal for clock generation 0xBC 0x9801 ANAIRQ...

Page 154: ...ing number Read the input port value 0x00 0x9892 GPIO_Config_PINV Gpio default configuration PINV Port Invert Port inversion register Each bit in the configuration register represents the GPIO pin wit...

Page 155: ...quest 0x01 request through CLKREQ pin GPIO pin 2 set to high when clock requested HighZ unless whatever GPIO default configuration 0x02 request through NXP_EVT_CLK_REQUEST event Others values are RFU...

Page 156: ...tion type A phase 0x06 0x9F13 PlMgtPassiveGTB Guard time in ms to be used in detection type B phase 0x06 0x9F14 PlMgtPassiveGTF Guard time in ms to be used in detection type F phases If previous phase...

Page 157: ...Timeout_MSB 0x00 0x9C28 AckHostTimeout_LSB PN544 Ack Timeout on Host link in 1ms step 0x0005 5ms 0x05 0x9C31 GuardHostTimeoutMSB 0x00 0x9C32 GuardHostTimeoutLSB Guard Host Timeout on Host link in 1ms...

Page 158: ...0x9F35 Card_Emulation_TO_MSB 0x04 0x9F36 Card_Emulation_TO_LSB Time for which PN544 stays in Card Emulation mode after leaving RF field from 0 to 3 145s in 48 s step 0x11 0x9F38 To 0x9F3D MIF_KEYSET0_...

Page 159: ...0 0x9F7A To 0x9F7F MIF_KEYSET5_KEY_B Key B of Keyset 5 for MIFARE authenticate command 0 0x9F80 To 0x9F85 MIF_KEYSET6_KEY_A Key A of Keyset 6 for MIFARE authenticate command 0 0x9F86 To 0x9F8B MIF_KE...

Page 160: ...code LSB 0x9F9E NfcT RFOFF TO_MSB 0x9F9F NfcT RFOFF TO_LSB In NFC target active Time the target wait after command reception has been ended and RF OFF before reinitializing To avoid active target in f...

Page 161: ...e_PMOS_LoadMod in PCD mode 0x3E 0x992F ANT Switch_ANT1 ANT2_to_GND 0x12 0x989E AntennaLdoCon1 Value used for antenna self test scenario 3 start value for current measurement 0x3F 0x989F AntennaCwGsPOn...

Page 162: ...orresponding GPIO is configured in output whatever PEN value If set to 0 and if the corresponding PEN bit is set to 1 the corresponding GPIO is configured in input 0xF822 DPUD Pull Down Enable registe...

Page 163: ...ip itself by reading out the version numbers 10 1 Reading PN544 Version Register As host we understand here a PC based solution SCR Tester with a PN544 Demo Board attached Please refer to ETSI HCI spe...

Page 164: ...lows Table 136 VERSION_SW description 1 st byte 2 nd byte 3 rd byte 7 4 3 0 7 0 7 0 RomLib Patch FlashLib Major FlashLib Minor E g First release will be coded as 10 1 0 RomLib 1 no Patch and FlashLib...

Page 165: ...e Access Rights Comment Length Default 10 NXP_FULL_VERSION_SW RO Version of the software as followed RomLibVersion RomLibBuildVersion eedata_SM_CustomerProjectVersion eedata_SM_RomBuildVersion PatchCo...

Page 166: ...le and fit for the customer s applications and products planned as well as for the planned application and use of customer s third party customer s Customers should provide appropriate design and oper...

Page 167: ...e with Timeout 59 Fig 34 Clock request with HCI Event acknowledge with HCI Event 60 Fig 35 Clock request with HCI Event acknowledge with Timeout 60 Fig 36 Clock request with CLKREQ pin 62 Fig 37 Clock...

Page 168: ...te 68 Table 59 SWP Events 68 Table 60 SWP Switch Mode Event 68 Table 61 SWP Switch Mode Event Parameters 69 Table 65 Polling Loop Management Gate 78 Table 66 Polling Loop events 78 Table 67 NXP_EVT_CL...

Page 169: ...Target Registry 127 Table 121 Reader RF Additional Commands 129 Table 122 NXP_WR_ACTIVATE_NEXT Response 130 Table 123 NXP_WR_ACTIVATE_NEXT Response Description 130 Table 124 NXP_WR_ACTIVATE_ID Comman...

Page 170: ...unication from Slave to Master PN544 to Host 31 7 4 8 3 Duplex Communication 32 8 ETSI Host Controller Interface Compliancy 33 8 1 ETSI HCI Commands Events Supported 33 8 2 ETSI HCI Registries Support...

Page 171: ...t as a Type A reader 133 9 15 3 Meaning of additional commands of Reader RF gates for Type A 133 9 15 3 1 Several Type A cards in the RF field use NXP_WR_ACTIVATE_NEXT NXP_WR_ACTIVATE_ID 133 9 15 3 2...

Page 172: ...on NXP B V 2010 All rights reserved For more information please visit http www nxp com For sales office addresses please send an email to salesaddresses nxp com Date of release 2010 06 16 Document ide...

Search results

Summary of Contents for PN544 C2

Reviews:

NXP Semiconductors PN544 C2, User Manual, Page: 34 / 172

Search results

Summary of Contents for PN544 C2

Reviews: