1
Features
·
13.56 MHz ± 7 kHz RFID Interface for Multi-chip Cards and Tags
·
Electrically Compatible with ISO/IEC 14443-2, Type B
·
Serial Channel Configurable to Communicate with External Chips
·
Supports SPI and Two-wire Serial EEPROM Interface
·
320 Read/Write EEPROM Bits, Divided into 10 Pages of 32 Bits
·
Password and Write Lock Protection
·
Programmable Send Protocols
·
Integrated Tuning Capacitor
·
ID Length Programmable from 4 to 18 Bytes
·
Optional 2-byte CRC
Description
The AT88RF001 is a stand-alone 13.56 MHz RFID front end that includes a serial port
suitable for connection to an external high-density serial memory. Using the on-board
EEPROM, it can be configured to communicate using various protocols and interface
to both two-wire and SPI external devices.
The device contains 320 bits of full read/write EEPROM memory and offers features
such as passwords, locking and a variable-length ID. It is electrically compatible with
ISO/IEC 14443-2, Type B. The IC includes an internal tuning capacitor; only an exter-
nal coil antenna is required to complete the RFID channel.
The serial channel is configurable to communicate with external ICs using either two-
wire or four-wire (SPI) serial channels, at a maximum speed of 106 kilobits per second
(Kbps). An external bypass capacitor will be required to filter and stabilize the supply
generated by the RFID front end. Up to 2 mA can be drawn by the external memory
when communications are not occurring.
Figure 1. Block Diagram
The AT88RF001 is intended to be used with serial EEPROMs such as Atmel's
AT24Cxx two-wire line or its AT25xx SPI line. In addition, it can communicate with an
external microprocessor if more complicated systems are to be built, if software on
that processor can model the slave protocol of the corresponding memories. It is
expected that a single external memory chip will be connected to the AT88RF001.
EEPROM
Serial Clock
Chip Select
Data Output
Data Input
VSS
VDD
Clock
Extraction
Data
Modulation
Control
Regulator
Bridge
Rectifier
RFID External
EEPROM
Interface IC
AT88RF001
Rev. 1943FRFID04/02
2
AT88RF001
1943FRFID04/02
General Operation
On power-up, the device will continuously repeat through the following sequence, which
includes an ID transmission and possible reception of a command. The sequence is
defined as follows:
1.
Framed transmission of the ID field:
- Start of Transmission (see
Data Communications,
page 6)
- Between 4 and 18 bytes from the EEPROM, which is defined as the ID field
- Optional 2-byte CRC
- End of Transmission (see
Data Communications,
page 6)
2.
A listening window, during which commands may be sent to the IC
All bits are sent to or read from the IC least significant bit first. Bit fields listed in this doc-
ument are listed with the LSB on the left and the MSB on the right.
Multi-byte information is sent to the IC least significant byte first. Although not visible to
the external system, within the IC, the first byte sent to the device is stored in memory at
the lowest address and the address is incremented for subsequent bytes.
Information is read from the EEPROM and transmitted by the IC in exactly the same
order in which it was written: the first bit written is the first bit read.
Information for the external I/O channel is transferred in the same order in which it is
transferred along the RFID channel.
ID Field
The ID sent by the IC can be between 4 and 18 bytes in length, depending on the value
of the PU_LEN field in the configuration page. EEPROM bytes not utilized for ID storage
may be used by the system for any other purpose.
Listening Window
After the power-up sequence is transmitted, there is a listening window during which the
tag looks for modulation that would initiate the transmission of a command from the
reader/writer to the tag. Commands sent at any other time are ignored.
The listening window is 8 bit-times long. The leading modulation edge of the SOT identi-
fier (see
Data Communications
, page 6) must not start within the first and/or last bit time
of the listening window. This restriction is enforced to prevent the IC receiver from see-
ing its own modulation.
3
AT88RF001
1943FRFID04/02
Command Bytes
The internal memory commands implemented in this tag permit the reader/writer to
directly access individual 4-byte pages within the internal memory array, prevent future
writing of particular pages (locking), temporarily disable the IC, or check a password
value. The external memory commands provide a channel for the reader to communi-
cate with the external memory through the RFID channel. In the event that the device
does not acknowledge the Check Password, Send Begin, Send End, Send Byte, or
Send Page commands, then the operation failed. The reader should wait 10 bit-times
from the time when the AT88RF001's SOT was supposed to start before issuing another
command.
These commands are encoded as follows:
Internal EEPROM Access
For the Read and all four Write commands, the data stored within the corresponding
page of the EEPROM is repeatedly transmitted back to the reader by the IC after the
command has completed. This permits a verify function for the commands. For the Write
Lock and Write Config commands, the entire contents of page 8 are transmitted.
Between each frame transmitted, there is a listening window of 8 bit-times to synchro-
nize the reader and/or permit the reader/writer to issue a new command to the IC. The
listening window will begin immediately following the transmission of the appropriate
EOT (see
Data Communications
section for information regarding EOT).
LSB
MSB
Command
A
0
A
1
A
2
A
3
0 0 0 1
Read 32-bit Page A A A A (followed by optional CRC)
A
0
A
1
A
2
0 0 0 1 0
Write 32-bit Page A A A (followed by 4 bytes of data and optional CRC)
0 0 0 0 0 0 1 1
Write Lock Byte (followed by 1 byte of data, 3 bytes of $AAH and optional CRC)
0 0 0 1 0 0 1 1
Write Configuration Bits (followed by 1 byte of $AAH, 3 bytes of data and optional CRC)
0 0 0 0 0 1 1 1
Write Password (followed by 4 bytes of data and optional CRC)
0 0 0 1 1 0 0 0
Disable (Stop) IC until Power-down (followed by optional CRC)
0 0 0 1 1 1 0 0
Check Password (followed by 4 bytes of data and optional CRC)
0 0 1 0 0 0 1 1
Send Byte to I/O Channel (followed by 1 byte of data and optional CRC)
0 0 1 0 0 1 1 1
Get Byte from I/O Channel (followed by optional CRC)
0 0 1 0 1 0 1 1
Send Page to I/O Channel (followed by # of bytes determined by PAGE_SIZE, CRC)
0 0 1 0 1 1 1 1
Get Page from I/O Channel (followed by optional CRC)
0 1 0 0 0 0 1 1
Send Begin Sequence to I/O Channel (CS low or START)
0 1 0 0 0 1 1 1
Send End Sequence to I/O Channel (CS high or STOP)
0 1 0 0 1 1 1 1
Send End Sequence to I/O Channel, Wait 6 ms (CS high or STOP)
0 1 0 1 0 1 1 1
Send End Sequence to I/O Channel, Wait 11 ms (CS high or STOP)
0 1 0 1 1 1 1 1
Send End Sequence to I/O Channel, Wait 21 ms (CS high or STOP)
4
AT88RF001
1943FRFID04/02
External Memory Access
The Send and Get commands transfer data from the RFID port to the serial I/O channel
bit by bit, using the proper protocol for the external memory as defined by the
SERIAL_MODE bits in the options page. The Send/Get Page commands transfer a
number of bytes as set in the options page, which could correspond to the page size in
the external memory. Any sequencing required in the external memory to perform writes
or other housekeeping should be performed with a series of Send/Get commands,
either as single bytes or as combinations of byte and page commands.
All Send/Get data commands to the external memory should be preceded with a start
sequence that is initiated with the Send Begin command. External memory operations
should be terminated with the Send End command. In two-wire mode, these commands
correspond to the start and stop conditions. In SPI mode, the Begin/End commands
assert and deassert the CS pin to the external memory.
If extra security is required before access to the external memory, the IC can be config-
ured such that the password must be entered before the Send Begin command will be
executed. Without this command being executed, accesses to the external memory can-
not happen.
After any Send, Get or Check Password command has properly executed, the IC enters
an infinite listening window during which additional commands can be sent to the IC.
After subsequent Send, Get or Check Password commands have been executed and/or
if illegal commands are sent to the device, it will return to this infinite listening window.
After subsequent internal memory access commands have been executed, the IC will
acknowledge the command by repeatedly transmitting the page accessed. Subsequent
illegal commands will result in the power-up ID transmission.
After any Send command that is received correctly (including encoding and/or CRC)
and acknowledged by the external memory, the IC will send a single-byte acknowledge
frame back to the reader in the form of a single byte of value 0xFF (and CRC, if
enabled).
In the case of the Send Begin/Send End commands, the absence of an acknowledge
response from the IC means that the various pin transitions to the external memory did
not occur at all. In the case of the other external memory access commands, the IC will
stop transitions to the external memory at the point of failure, and the reader must deter-
mine the proper course of action to recover the external memory state.
After the Send End command is initiated, the command encoding may specify that a
delay occurs after the acknowledge is sent back to the reader. Because of the architec-
ture of the power generation circuitry, it is recommended that these delays be used
whenever writes will be taking place within the external memory. During the delay time,
the IC will be configured to supply extra power to the external memory device, and com-
munications to the AT88RF001 will be disabled during the delay period.
The system can send any command (either external or internal memory access) during
any listening window. To return to the default state and transmit the ID, the carrier power
can be cycled off and on.
5
AT88RF001
1943FRFID04/02
Write Protection
There are a number of features that are used to prevent inadvertent writing of the
device:
1.
The proper command code plus the proper receive data encoding must be sent
to the IC. If either an illegal code or improper encoding is detected, the command
is aborted.
2.
Optionally, 2 CRC bytes may be sent after the command and data bytes (see
below for details), which must also be correct.
3.
For the Write Lock command, a successful Write Page command must have
been previously executed since the last power cycle in order for the Write Lock
command to be executed.
If any of these protections are violated, or if there is a transmission or protection failure
(lock bit set, password not entered), or if an illegal command is sent, the internal
EEPROM will not be written.
Data Locking
Within the lock byte, each lock bit determines whether the corresponding 4-byte user
page can be written to. If it contains a "1", then writes are prohibited; if "0", they are
allowed. The data sent to the IC with the Write Lock operation is ORed with the data
already in the lock byte and then rewritten to the EEPROM. Once a user page is locked,
it may never be unlocked and may never be written to.
There are two additional lock bits for pages 8 (CONFIG_LOCK) and 9 (PW_LOCK).
They operate slightly differently from the user lock bits because there is no OR function.
CONFIG_LOCK, if "1", prevents the execution of the Write Config Bits command, while
PW_LOCK, if "1", prevents execution of the Write Password command. Turning on
CONFIG_LOCK does not lock the value of the bits within the lock byte but does prevent
further change to the PW_LOCK bit and the other configuration bits.
Passwords
If the optional password mode is enabled with PW_ON, command-based reads and
writes are prohibited until the correct password is sent using the Check Password com-
mand. If the transmitted value of the password is correct, then an internal latch is set
and subsequent Read, Write and Lock commands (to any page, including the password
page, #9) are permitted. If the wrong password is sent (to the password check), then the
command is aborted. Writes to locked pages are never permitted regardless of
passwords.
If PW_EXT is set to "1", then the Send Begin command may not be executed until the
correct password has been sent to the IC using the Check Password command. The
state of PW_ON does not affect whether or not the password is required to execute the
Send Begin command.
There is no command that can be used to directly read the password page, regardless
of whether or not the password option (PW_ON or PW_EXT) is enabled.
Simple I/O Mode
When the IC is configured for simple I/O mode, the state of two output pins can be con-
trolled by the reader, and the state of two input pins can be determined by the reader. To
enable this mode, SERIAL_MODE should be set to the "simple I/O" state.
When the Send Byte command is executed, bit 0 of the data will be driven to the SCK
pin and bit 1 of the data will be driven to the CS pin. Bits 27 are ignored. When the Get
Byte command is executed, bit 0 will reflect the current state of the SO pin and bit 1 will
reflect the state of the SI pin. Bits 27 will be 0.
PDF 
ZIP