View MAX66040K_1084594.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

max66040 iso/iec 14443 type b-compliant secure memory ________________________________________________________________ maxim integrated products 1 219-0012; rev 0; 1/11 for pricing, delivery, and ordering information, please contact maxim direct at 1-888-629-4642, or visit maxim? website at www.maxim-ic.com. abridged data sheet general description the max66040 combines 1024 bits of user eeprom with secure hash algorithm (sha-1) challenge-and- response authentication (iso/iec 10118-3 sha-1), a 64-bit unique identifier (uid), one 64-bit secret, and a 13.56mhz rf interface (iso/iec 14443 type b, parts 2- 4) in a single chip. the memory is organized as 16 blocks of 8 bytes plus three more blocks, one for the secret and two for data and control registers. except for the secret, each block has a user-readable write-cycle counter. four adjacent user eeprom blocks form a memory page (pages 0 to 3). the integrated sha-1 engine provides a message authentication code (mac) using data from the eeprom of the device and the 64- bit secret to guarantee secure, symmetric authentica- tion for both reading and writing to the device. memory protection features are write protection and eprom emulation, which the user can set for each individual memory page. page 3 can also be read-protected for enhanced authentication strength. memory access is accomplished through the block transmission protocol (iso/iec 14443-4), where requests and responses are exchanged through i-blocks once a device is in the active state. the data rate can be as high as 847.5kbps. the reader must support a frame size of 26 bytes. the device supports an application family identi- fier (afi) and a card identifier (cid). iso/iec 14443 functions not supported are chaining, frame-waiting time extension, and power indication. applications driver identification (fleet application) access control e-cash asset tracking features ? fully compliant iso/iec 14443 (parts 2-4) type b interface ? 13.56mhz ?khz carrier frequency ? 1024-bit secure user eeprom with block lock feature, write-cycle counter, and optional eprom-emulation mode ? 64-bit uid ? 512-bit sha-1 engine to compute 160-bit mac and to generate secrets ? mutual authentication: data read from device is verified and authenticated by the host with knowledge of the 64-bit secret ? read and write (64-bit block) ? supports afi and cid function ? 10ms maximum programming time ? write: 10% ask modulation at 105.9kbps, 211.9kbps, 423.75kbps, or 847.5kbps ? read: load modulation using bpsk modulated subcarrier at 105.9kbps, 211.9kbps, 423.75kbps, or 847.5kbps ? 200,000 write/erase cycles (minimum) ? 40-year data retention (minimum) ic load switched load magnetic coupling antenna rx_in tx_out transmitter 13.56mhz reader max66040 typical operating circuit evaluation kit available ordering information + denotes a lead(pb)-free/rohs-compliant package. part temp range pin-package max66040e-000aa+ -25c to +50c iso card MAX66040K-000aa+ -25c to +50c key fob mechanical drawings appear at end of data sheet.
max66040 iso/iec 14443 type b-compliant secure memory 2 _______________________________________________________________________________________ abridged data sheet absolute maximum ratings electrical characteristics (t a = -25? to +50?.) (note 1) stresses beyond those listed under ?bsolute maximum ratings?may cause permanent damage to the device. these are stress rating s only, and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of the specificatio ns is not implied. exposure to absolute maximum rating conditions for extended periods may affect device reliability. note 1: system requirement. note 2: measured from the time at which the incident field is present with strength greater than or equal to h (min) to the time at which the max66040? internal power-on reset signal is deasserted and the device is ready to receive a command frame. not characterized or production tested; guaranteed by simulation only. maximum incident magnetic field strength ..........141.5db?/m operating temperature range ...........................-25? to +50? relative humidity ..............................................(water resistant) storage temperature range ...............................-25? to +50? parameter symbol conditions min typ max units sha-1 engine sha-1 computation time t csha refer to the full data sheet. m s eeprom programming time t prog 9 10 ms endurance n cycle at +25c 200,000 cycles data retention t ret 40 years rf interface carrier frequency f c (note 1) 13.553 13.560 13.567 mhz at +25c, max66040e 110.0 137.5 operating magnetic field strength (note 1) h at +25c, MAX66040K 123.5 137.5 dba/m power-up time t por (note 2) 1.0 ms
max66040 detailed description the max66040 combines 1024 bits of user eeprom, 128 bits of user and control registers, a 64-bit uid, one 64-bit secret, a 512-bit sha-1 engine, and a 13.56mhz rf interface (iso/iec 14443 type b, parts 2-4) in a sin- gle chip. the memory is organized as 19 blocks of 8 bytes each. except for the secret, each block has a user-readable write-cycle counter. four adjacent user eeprom blocks form a memory page (pages 0 to 3). memory protection features include write protection and eprom emulation, which the user can set for each individual memory page. page 3 can also be read pro- tected for enhanced authentication strength. the max66040 is accessed through the iso/iec 14443-4 block transmission protocol, where requests and responses are exchanged through i-blocks once a device is in the active state. the reader must support a frame size of at least 26 bytes. the data rate can be as high as 847.5kbps. the max66040 supports afi and cid. functions not supported are chaining, frame- waiting time extension, and power indication. applications of the max66040 include driver identifica- tion (fleet application), access control, electronic cash (e-cash), and asset tracking. overview figure 1 shows the relationships between the major control and memory sections of the max66040. the device has six main data components: 64-bit uid, 64-bit read/write buffer, four 256-bit pages of user eeprom, two 8-byte blocks of user and control regis- ters, 64-bit secret? memory, and a 512-bit sha-1 engine. figure 2 shows the hierarchical structure of the iso/iec 14443 type b-compliant access protocol. the master must first apply network function commands to put the max66040 into the active state before the memory and control functions become accessible. the protocol required for these network function commands is described in the network function commands sec- tion. once the max66040 is in the active state, the master can issue any one of the available memory and control function commands. upon completion of such a command, the max66040 returns to the active state and the master can issue another memory and control function command or deselect the device, which returns it to the halt state. the protocol for these memory and control function commands is described in the memory and control function commands section. all data is read and written least significant bit (lsb) first, starting with the least significant byte (lsb). parasite power as a wireless device, the max66040 is not connected to any power source. it gets the energy for operation from the surrounding rf field, which needs to have a minimum strength as specified in the electrical characteristics table. rf front- end voltage regulator internalsupply memory and function control iso 14443 frame formatting and error detection read/write buffer secret uid register block user eeprom sha-1 engine f c data modulation figure 1. block diagram iso/iec 14443 type b-compliant secure memory _______________________________________________________________________________________ 3 abridged data sheet
max66040 unique identification number (uid) each max66040 contains a factory-programmed and locked identification number that is 64 bits long (figure 3). the lower 36 bits are the serial number of the chip. the next 8 bits store the device feature code, which is 03h. bits 45 to 48 are 0h. the code in bit loca- tions 49 to 56 identifies the chip manufacturer, accord- ing to iso/iec 7816-6/am1. this code is 2bh for maxim. the code in the upper 8 bits is e0h. the uid is read accessible through the get uid and get system information commands. the lower 32 bits of the uid are transmitted in the pupi field of the atqb response to the reqb, wupb, or slot-marker command. by default, the upper 32 bits of the uid are factory pro- grammed into the application data field, which is trans- mitted as part of the atqb response. this way the master receives the complete uid in the first response from the slave. see the network function commands section for details. detailed memory description iso/iec 14443 type b-compliant secure memory 4 _______________________________________________________________________________________ abridged data sheet available commands: data field affected: request (reqb) wakeup (wupb) slot-marker halt (hltb) select (attrib) deselect (deselect) afi, administrative data afi, administrative data (administrative data) pupi pupi, administrative data (administrative data) network function commands get system information 64-bit uid, afi, constants get uid 64-bit uid memory and control function commands command level: max66040 figure 2. hierarchical structure of iso/iec 14443 type b protocol msb lsb 64 57 56 49 48 45 44 37 36 1 e0h 2bh 0h feature code (03h) 36-bit ic serial number figure 3. 64-bit uid refer to the full data sheet. refer to the full data sheet for this information.
max66040 iso/iec 14443 type b-compliant secure memory _______________________________________________________________________________________ 7 iso/iec 14443 type b communication concept the communication between the master and the max66040 (slave) is based on the exchange of data packets. the master initiates every transaction; only one side (master or slaves) transmits information at any time. data packets are composed of characters, which always begin with a start bit and typically end with one or more stop bits (figure 5). the least significant data bit is transmitted first. data characters have 8 bits. each data packet begins with a start-of-frame (sof) character and ends with an end-of-frame (eof) charac- ter. the eof/sof characters have 9 all-zero data bits (figure 6). the sof has 2 stop bits, after which data characters are transmitted. a data packet with at least 3 bytes between sof and eof is called a frame (figure 7). the last two data characters of an start 1 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 8 lsb msb stop figure 5. iso/iec 14443 data character format abridged data sheet
iso/iec 14443 type b frame are an inverted 16-bit crc of the preceding data characters generated according to the crc-16-ccitt polynomial. this crc is transmitted with the lsb first. for more details on the crc-16-ccitt, refer to iso/iec 14443-3, annex b. with network function commands, the command code, parameters, and response are embedded between sof and crc. with memory function commands, com- mand code, and parameters are placed into the infor- mation field of i-blocks (see the block types section), which in turn are embedded between sof and eof. for transmission, the frame information is modulated on a carrier frequency, which in the case of iso/iec 14443 is 13.56mhz. the subsequent paragraphs are a con- cise description of the required modulation and coding. for full details including sof/eof and subcarrier on/off timing, refer to iso/iec 14443-3, sections 7.1 and 7.2. the path from master to slave uses amplitude modula- tion with a modulation index between 8% and 14% (figure 8). in this direction, a start bit and logic 0 bit correspond to a modulated carrier; stop bit and logic 1 bit correspond to the unmodulated carrier. eof ends with an unmodulated carrier instead of stop bits. max66040 iso/iec 14443 type b-compliant secure memory 8 _______________________________________________________________________________________ abridged data sheet start 1 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 9 stop/idle bit 8 figure 6. iso/iec 14443 sof/eof character format sof one or more data characters crc (lsb) crc (msb) eof time figure 7. iso/iec 14443 frame format a b carrier amplitude t 11 1 1 00 modulation index m = = 0.08 to 0.14 a - b a + b figure 8. downlink: 8% to 14% amplitude modulation
the path from slave to master uses an 847.5khz sub- carrier, which is modulated using binary phase-shift key (bpsk) modulation. depending on the data rate, the transmission of a single bit takes 8, 4, 2 or 1 subcarrier cycles. the slave generates the subcarrier only when needed; i.e., starting shortly before an sof and ending shortly after an eof. the standard defines the phase of the subcarrier before the sof as 0 reference, which corresponds to logic 1. the phase of the subcarrier changes by 180 whenever there is a binary transition in the character to be transmitted (figure 9). the first phase transition represents a change from logic 1 to logic 0, which coincides with the beginning of the sof. the bpsk modulated subcarrier is used to modulate the load on the device? antenna (figure 10). max66040 data to be transmitted indicates 180 phase change (polarity reversal) or 11 0 847khz subcarrier bpsk modulation transmission of a single bit power-up default = eight cycles of 847khz (9.44 s) can be reduced to four, two, or one subcarrier cycles for communication in the active state. figure 9. uplink: bpsk modulation of the 847.5khz subcarrier transmission of a single bit shown as eight cycles of the 847khz subcarrier data* *depending on the initial phase, the data polarity may be inverse. 10 1 figure 10. uplink: load modulation of the rf field by the bpsk modulated subcarrier iso/iec 14443 type b-compliant secure memory _______________________________________________________________________________________ 9 abridged data sheet
max66040 iso/iec 14443 block transmission protocol before the master can send a data packet to access the memory, the max66040 must be in the active state. the protocol to put the max66040 into the active state is explained in the network function commands sec- tion. while in the active state, the communication between master and max66040 follows the block trans- mission protocol as specified in section 7 of iso/iec 14443-4. such a block (figure 11) consists of three parts: the prologue field, the information field, and the epilogue field. the prologue can contain up to 3 bytes, called the protocol control byte (pcb), card identifier (cid), and the node address (nad). epilogue is another name for the 16-bit crc that precedes the eof. the information field is the general location for data. block types the standard defines three types of blocks: i-block, r-block, and s-block. figures 12, 13, and 14 show the applicable pcb bit assignments. the i-block is the main tool to access the memory and to run the sha-1 engine. for i-blocks, bit 2 must be 1 and bit 6, bit 7, and bit 8 must be 0. bit 5, marked as ch, is used to indicate chaining, a function that is not used or supported by the max66040. therefore, bit 5 must always be 0. bit 4, marked as cid, is used by the master to indicate whether the prologue field contains a cid byte. the max66040 processes blocks with and without cid as defined in the standard. the master must include the cid byte if bit 4 is 1. bit 3, marked as nad, is used to indicate whether the prologue field contains an nad byte, a feature not supported by the max66040. therefore, bit 3 must always be 0. bit 1, marked as #, is the block number field. the block num- ber is used to ensure that the response received relates to the request sent. this function is important in the error handling, which is illustrated in annex b of iso/iec 14443-4. the rules that govern the numbering and handling of blocks are found in sections 7.5.3 and 7.5.4 of iso/iec 14443-4. the max66040 ignores i-blocks that have bit 5 or bit 3 set to 1. for r-blocks, the states of bit 2, bit 3, and bit 6, bit 7, and bit 8 are fixed and must be transmitted as shown in figure 13. the function of bit 1 (block number) and bit 4 (cid indicator) is the same as for i-blocks. bit 5, marked as an, is used to acknowledge (if transmitted as 0) or not to acknowledge (if transmitted as 1) the reception of the last frame for recovery from certain error conditions. the max66040 fully supports the func- tion of the r-block as defined in the standard. for details and the applicable rules, refer to sections 7.5.3 and 7.5.4 and annex b of iso/iec 14443-4. iso/iec 14443 type b-compliant secure memory 10 ______________________________________________________________________________________ abridged data sheet prologue field information field epilogue field pcb cid nad (data) crc (lsb) crc (msb) 1 byte 1 byte 1 byte 0 or more bytes 1 byte 1 byte figure 11. iso/iec 14443-4 type b block format bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb 0 0 0 ch cid nad 1 # figure 12. bit assignments for i-block pcb bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb 1 0 1 an cid 0 1 # figure 13. bit assignments for r-block pcb
for s-blocks, the states of bit 1, bit 2, and bit 3, and bit 7 and bit 8 are fixed and must be transmitted as shown in figure 14. the function of bit 4 (cid indicator) is the same as for i-blocks. bit 5 and bit 6, when being 00b, specify whether the s-block represents a deselect com- mand. if bit 5 and bit 6 are 11b, the s-block represents a frame-waiting time extension (wtx) request, a feature to tell the master that the response is going to take longer than specified by the frame-waiting time (fwt) (see the atqb response section). however, the max66040 does not use this feature and consequently, the only use of the s-block is to transition the device from the active state to the halt state using the deselect command (see the network function commands section). card identifier figure 15 shows the bit assignment within the card identifier byte. the purpose of bits 4 to 1 is to select one of multiple slave devices that the master has ele- vated to the active state. the cid is assigned to a slave through param 4 of the attrib command (see the network function commands section). while in active state, a compliant slave only processes blocks that contain a matching cid and blocks without cid if the assigned cid is all zeros. if the master includes a cid, then the slave? response also includes a cid byte. blocks with a nonmatching cids are ignored. according to the standard, the slave can use bits 8 and 7 to inform the master whether power-level indication is supported, and, if yes, whether sufficient power is avail- able for full functionality. since the max66040 does not support power-level indication, the power-level bits are always 00b. when the master transmits a cid byte, the power-level bits must be 00b. information field since the max66040 does not generate wtx requests, the information field (figure 11) is found only with i-blocks. the length of the information field is calculated by counting the number of bytes of the whole block minus length of prologue and epilogue field. the iso/iec 14443 standard does not define any rules for the contents of the information field. the max66040 assumes that the first byte it receives in the information field is a command code followed by 0 or more com- mand-specific parameters. when responding to an i-block, the first byte of the information field indicates success (code 00h) followed by command-specific data or failure (code 01h) followed by one error code. memory and control function commands the commands described in this section are transmit- ted using the block transmission protocol. the data of a block (from prologue to epilogue) is embedded between sof and eof, as shown in figure 16. the cid field (shaded) is optional. if the request contains a cid, the response also contains a cid. the command descriptions in this section only show the information field of the i-blocks used to transmit requests and responses. since the max66040 neither supports chaining nor generates wtx requests, when it receives an i-block, the max66040 responds with an i-block. the block number in the i-block response is the same as in the i-block request. max66040 iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 11 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb 1 1 cid 0 1 0 figure 14. bit assignments for s-block pcb bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb 0 0 00 (power level) (fixed) card identifier value figure 15. bit assignments for cid byte in i-blocks pcb cid sof information field crc (msb) crc (lsb) eof figure 16. frame format for block transmission protocol abridged data sheet
error indication depending on the complexity of a function, various error conditions can occur. in case of an error, the response to a request begins with a 01h byte followed by one error code. table 5 shows a matrix of commands and potential errors. if there was no error, the information field of the response begins with 00h followed by command-spe- cific data, as specified in the detailed command description. if the max66040 does not recognize a command, it does not generate a response. max66040 iso/iec 14443 type b-compliant secure memory 12 ______________________________________________________________________________________ abridged data sheet table 5. error code matrix refer to the full data sheet for this information.
detailed command descriptions get system information this command allows the master to retrieve technical information about the max66040. in the response, the least significant uid byte is transmitted first. the response is adapted from iso 15693-3, section 10. the ic reference code indicates the die revision in hexa- decimal format, such as a1h, a2h, b1h, etc. to receive the system information, issue a request with the com- mand code 2bh in the request information field. for additional command descriptions, refer to the full data sheet. max66040 indicator info flags uid u1 afi number of blocks memory block size ic reference 00h 0fh (8 bytes) (1 byte) (1 byte) 13h 07h (1 byte) response information field for the get system information command (no error) iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 13 abridged data sheet
max66040 get uid this command allows the master to retrieve the device? unique identification number, uid. in the response, the least significant uid byte is transmitted first. to read the uid, issue a request with the com- mand code 30h in the request information field. indicator uid 00h (8 bytes) response information field for the get uid command (no error) iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 21 abridged data sheet
max66040 iso/iec 14443-3 type b initialization and anticollision protocol before an iso/iec 14443-compliant rf device gives access to its memory, a communication path between the master and the rf device must be established. initially, the master has no information whether there are any rf devices in the field of its antenna. to find out whether there are one or more rf devices compliant to a known standard in the field, the master uses a stan- dard-specific initialization and anticollision protocol. the iso/iec 14443 type b protocol defines six states: power-off, idle, waiting for slot-marker, ready, halt, and active. figure 17 shows these states and the conditions under which a slave transi- tions between states. for most cases, letters surround- ed by small circles reference the condition under which a transition occurs. the conditions are explained in the legend to figure 17. table 14 explains terms that are used in the anticollision protocol and in the network function command description. iso/iec 14443 type b-compliant secure memory 22 ______________________________________________________________________________________ abridged data sheet
max66040 iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 23 idle ready power-off waiting for slot-marker* active halt any other command in field any other command or case out of field (from any state) any other command response legend: *when entering ?waiting for slot-marker,? each tag selects a random number r in the range of 1 to ?number of slots.? deselect (special case of a block transmission protocol function) atqb response 1 a a b s a b s s b ms 1 1 1 4 3 2 attrib response 2 hltb response 3 deselect response 4 any other command or case any other command or case attrib with matching pupi hltb with matching pupi executive block transmission protocol function figure 17. iso/iec 14443 type b state transitions diagram name description result a (afi mismatch) reqb/wupb with nonmatching afi a wupb with nonmatching afi return to idle b (bypass sm) reqb/wupb with matching afi and [(n = 1) or [r = 1)] b wupb with matching afi and [(n = 1) or [r = 1)] transition directly to ready s (slot-marker) reqb/wupb with matching afi and (n 1) and (r 1) s wupb with matching afi and (n 1) and (r 1) wait for matching slot number ms (matching slot) slot-marker command with slot number = r transition to ready with matching slot-marker conditions legend: abridged data sheet
max66040 iso/iec 14443 type b-compliant secure memory 24 ______________________________________________________________________________________ abridged data sheet term description active one of the slaves six states. in this state, the memory and control function commands and deselect apply. adc application data coding. 2-bit field of the 3rd protocol info byte of the atqb response. afi application family identifier. 1-byte field used in the reqb/wupb request to preselect slaves. atqb answer to request, type b. response to reqb, wupb, and slot-marker command. attrib slave selection command, type b. used to transition a slave from ready to the active state. bpsk binary phase-shift keying modulation cid card identifier. 4-bit temporary identification number assigned to a slave through the attrib command, used in conjunction with the block transmission protocol. eof end of frame deselect slave deselection command. transitions the slave from the active state to the halt state. fc carrier frequency = 13.56mhz fo frame option. 2-bit field of the 3rd protocol info byte of the atqb response. fs subcarrier frequency = f c /16 = 847.5khz fwi frame-waiting time integer. 4-bit field of the 3rd protocol info byte of the atqb response. fwt frame-waiting time. calculated from fwi. halt one of the slaves six states. the master puts a slave in this state to park it. hltb halt command, type b idle one of the slaves six states. in this state, the slave has power and is waiting for action. inf information field for higher layer protocol (per iso/iec 14443-4) mbli maximum buffer length index of slave (per iso/iec 14443-4). 4-bit field of the first protocol info byte of the atqb response. n number of anticollision slots (or response probability per slot) nad node address (per iso/iec 14443-4) power-off one of the slaves six states. in this state, the slave has no power and consequently cannot do anything. pupi pseudo unique identifier. 4-byte field of the atqb response. r 4-bit random number chosen by a slave when processing the reqb or wupb command ready one of the slaves six states; official name is ready-declared substate. in this state, the slave has identified itself and is waiting for transition to active (memory and control functions) or halt (parking). reqb request command, type b. used to probe the rf field for the presence of slave devices. rf radio frequency s slot number. 4-bit field sent to slave with slot-marker command. slot-marker command used in the time-slot approach to identify slaves in the rf field sof start of frame tr0 guard time per iso/iec 14443-2 tr1 synchronization time per iso/iec 14443-2 waiting for slot-marker one of the slaves six states; official name is ready-requested substate. in this state, the slave is waiting to be called by its random number r to transition to ready. wupb wake-up command, type b. similar to reqb, required to wake up slaves in the halt state. table 14. iso/iec 14443 type b technical terms
max66040 iso/iec 14443 type b states and transitions power-off state this state applies if the slave is outside the master? rf field. a slave transitions to the power-off state when leaving the power-delivering rf field. when entering the rf field, the slave automatically transitions to the idle state. idle state the purpose of the idle state is to have the slave pop- ulation ready to participate in the anticollision protocol. when transitioning to the idle state, the slave does not generate any response. to maintain this state, the slave must continuously receive sufficient power from the master? rf field to prevent transitioning into the power-off state. while in the idle state, the slave lis- tens to the commands that the master sends, but reacts only on the reqb and wupb commands, provided that they include a matching afi value. if the master sends a command with a nonmatching afi byte (conditions a and a), a transition to idle is also possible from the halt state, the ready state, and the waiting for slot-marker state. from idle, a slave can transition to the higher states ready (condition b) or waiting for slot-marker (condition s). for details, see the reqb/wupb command description in the network function commands section. waiting for slot-marker state (ready requested substate) the waiting for slot-marker state is used in the time-slot anticollision approach. a slave can transition to waiting for slot-marker from the idle, halt, or ready state upon receiving a reqb or wupb com- mand with a matching afi (conditions s and s), provid- ed that both the number of slots specified in the reqb/wupb command and the random number that the slave has chosen are different from 1. to maintain this state, the slave must continuously receive sufficient power from the master? rf field to prevent transitioning into the power-off state. a slave in the waiting for slot-marker state listens to the commands that the master sends, but reacts only on the reqb, wupb, and slot-marker commands. from waiting for slot-marker, a slave can transition to the higher state ready under condition b (bypassing the slot- marker), or ms (matching slot, slot-marker com- mand with a slot number that matches the random number r). condition a (afi mismatch) returns the slave to the idle state. ready state (ready declared substate) the ready state applies to a slave that has met the cri- teria in the anticollision protocol to send an atqb response. a slave can transition to ready from idle or halt (conditions b and b) or from waiting for slot-marker (conditions b and ms). when transition- ing to the ready state, the slave transmits an atqb response. to maintain this state, the slave must contin- uously receive sufficient power from the master? rf field to prevent transitioning into the power-off state. a slave in the ready state listens to the commands that the master sends, but reacts only on the reqb, wupb, attrib and hltb commands. from ready, a slave can transition to active (attrib command with matching pupi), halt (hltb command with matching pupi), or idle (condition a). halt state the halt state is used to silence slaves that have been identified and shall no longer participate in the anticollion protocol. this state is also used to park slaves after communication in the active state was completed. a slave transitions to the halt state either from ready (hltb command with matching pupi) or from active (deselect command with matching cid). when transitioning to the halt state, the slave transmits a response that confirms the transition. to maintain this state, the slave must continuously receive sufficient power from the master? rf field to prevent transitioning into the power-off state. the normal way out of the halt state is through the wupb com- mand. from halt, a slave can transition to idle (con- dition a), ready (condition b), or waiting for slot-marker (condition s). active state the active state enables the slave to process com- mands sent through the block transmission protocol. when entering the active state, the slave confirms the transition with a response. the only way for a slave to transition to the active state is from the ready state (attrib command with a matching pupi). in the attrib command, the master assigns a 4-bit cid that is used to address one of multiple slaves that could all be in the active state. to maintain this state, the slave must continuously receive sufficient power from the master? rf field to prevent transitioning into the power-off state. the normal way out of the active state is through the deselect command, which transi- tions the slave to the halt state. iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 25 abridged data sheet
max66040 network function commands to transition slaves devices between states, the iso/iec 14443 type b standard defines six network function commands, called reqb, wupb, slot- marker, hltb, attrib, and deselect. the master issues the commands in the form of request frames and the slaves respond by transmitting response frames. with network function commands, command code, parameters and response are embedded between sof and crc. this section describes the format of the response and request frames and the coding of the data fields inside the frames as detailed as necessary to operate the max66040. not all of the fields and cases that the standard defines are relevant for the max66040. for a full description of those fields refer to the iso/iec 14443-3, section 7. reqb/wupb command the request command, type b (reqb) and the wakeup command, type b (wupb) are the general tools for the master to probe the rf field for the pres- ence of slave devices and to preselect them for action based on the value of the application family identifier (afi). an iso/iec 14443 type b-compliant slave watches for these commands while in the idle state, waiting for slot-marker state, and ready state. in the halt state, the slave only acts upon receiving a wupb command. the reqb or wupb command is transmitted as a frame, as shown in figure 18. besides the command code, the request includes two parameters, afi and param. the response to reqb/wupb is named atqb. see the atqb response section for details. the iso/iec 14443 standard defines rules for the assignment of the afi codes and the behavior of the slaves when receiving a reqb/wupb request. if the request specifies an afi of 00h, a slave must process the command regardless of its actual afi value. if the least significant nibble of the afi in the request is 0000b, the slave must process the command only if the most significant nibble of the afi sent by the master matches the most significant nibble of the slave? afi. for all other afi values, the slave processes the com- mand only if the afi in the request and the slave match. the afi code can be programmed and locked by the user. for details see the memory and control function commands section. the bit assignments of the param byte are shown in figure 19. bits 5 to 8 are reserved and must be trans- mitted as 0. bit 4, if 0, indicates that the request is a reqb command; bit 4, if 1, defines a wupb command. bits 1, 2, and 3 specify the number of slots (n) to be used in the anticollision protocol. table 15 shows the codes. in the case of n = 1, the slot-marker com- mand does not apply and all slaves with a matching afi transition to the ready state. with multiple slaves in the field, this leads to a data collision, since the response frames are transmitted simultaneously. if n is larger then 1, each slave in the field selects its own 4-bit random iso/iec 14443 type b-compliant secure memory 26 ______________________________________________________________________________________ abridged data sheet command sof afi crc param eof 05h (1 byte) (2 bytes) (1 byte) figure 18. reqb/wupb request frame bit 8 bit 7 bit 6 bit 5 bit 4 reqb/ wupb bit 3 bit 2 bit 1 msb lsb 0 0 00 (fixed) n figure 19. bit assignments for param byte bit 3 bit 2 bit 1 n 0 0 0 1 0 0 1 2 0 1 0 4 0 1 1 8 1 0 0 16 1 0 1 (reserved) 1 1 x (reserved) table 15. number of slots codes
number, r, in the range of 1 to n. a slave that happens to choose r = 1 responds to the reqb/wupb request. the larger n is the lower the probability of colliding response frames; however, if n is 16 and there is only a single slave in the field, it can take up to 15 slot- marker commands to get a response. the method to identify all slaves in the field relying solely on the ran- dom number r and the reqb/wupb command is called the ?robabilistic approach.?for mode informa- tion about the anticollision process see the anticollision examples section. slot-marker command instead of relying on the fact that a participating slave chooses a new random number for every reqb/wupb command, in the ?ime-slot approach?the master calls the slaves by their random number r using the slot- marker command. before this can be done, the mas- ter must have issued the reqb/wupb command with a number of slots (n) value greater than 1. the master can send up to (n - 1) slot-marker commands. figure 20 shows the format of the slot-marker request frame. the afi field is not needed since the slaves have already been preselected through the pre- ceding reqb/wupb request. the response to the slot-marker command is called atqb. see the atqb response section for details. the bits marked as ?nnn?specify the slot number as defined in the table 16. any sequence of the allowable slot numbers is permitted. atqb response the response for both the reqb/wupb and the slot- marker command is called atqb, which stands for ?nswer to request, type b.?figure 21 shows the for- mat of the atqb response. the pupi field (pseudo- unique identifier) is used by the master to address a slave for transitioning to the active or halt state. the data reported as pupi is the least significant 4 bytes of the 64-bit uid. the application data field reports user- defined data that is relevant for distinguishing otherwise equal slaves in the rf field. application data is the first 4 bytes of memory block 10h. by default, the applica- tion data field is factory programmed to reflect the most significant 4 bytes of the 64-bit uid. this allows the master to obtain the full 64-bit uid in the first response from the slave. however, since this field is not factory locked, it may be written to any value. the protocol info field provides the master with admin- istrative information, such as data rate, frame size, iso/iec 14443-4 compliance, frame waiting time, and whether the slave supports cid and nad in the iso/iec 14443-4 block transmission protocol. figure 22 max66040 iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 27 command sof crc eof nnnn0101b (2 bytes) figure 20. slot-marker request frame indicator sof crc eof 50h application data (4 bytes) (2 bytes) protocol info (3 bytes) pupi (4 bytes) figure 21. atqb response frame bit 8 bit 7 bit 6 bit 5 slot number 0 0 0 1 2 0 0 1 0 3 0 0 1 1 4 1 1 1 0 15 1 1 1 1 16 table 16. slot numbering abridged data sheet
max66040 shows where this information is located in the protocol info field and what the values are. the bit-rate capability of the max66040 ranges from 105.9kbps to 847.5kbps in both directions (request and response); request and response bit rate need not be the same. the maximum frame size (upper nibble of the 2nd byte) of any request/response specifies 32 bytes. the largest frame that occurs with the max66040 is 26 bytes (copy buffer request, compute page mac response). the protocol type (lower nibble of the 2nd byte) specifies that the max66040 supports the iso/iec 14443-4 block transmission protocol. the fwi code 0111b specifies a frame waiting time of 38.7ms, which is long enough to generate a computed secret. note that a slave may respond long before the maxi- mum frame waiting time is expired. the adc code 00b specifies that the max66040 uses proprietary coding for the application data field. the fo code 01b implies that the max66040 supports cid, but does not support the nad field in the iso/iec 14443-4 block transmis- sion protocol. hltb command the hltb command is the only network function com- mand to silence a slave by parking it in the halt state. if, based on the atqb response, the master does not want to further communicate with the slave, the master issues the hltb command. figures 23 and 24 show the format of the hltb request frame and the corre- sponding response frame. the data to be used in the pupi field must match the pupi information that the slave has transmitted in the atqb response. while in the halt state, the slave only responds to the wupb request. attrib command the attrib command is the only way to select a slave and make it process commands that are transmitted according to the iso/iec 14443 block transmission pro- tocol. if, based on the atqb response, the master wants to communicate with the slave, the master must put the slave into the active state using the slave selection command attrib. the normal way for the master to move a slave out of the active state is by sending a deselect command, which uses an s-block to convey a network function command. figure 25 shows the format of the attrib request frame. the data to be used in the pupi field must match the pupi information that the slave has transmit- ted in the atqb response. param 1 tells the slave how much time the master needs to switch from transmit to receive (tr0), how much time the master needs to syn- chronize to the slave? subcarrier (tr1), and whether the master is capable of receiving response frames without sof and/or eof. the max66040 ignores the data of param 1. to ease requirements for iso/iec 14443 type b readers, the max66040 has tr0 and tr1 fixed at 128/fs (151?; fs is the subcarrier frequency of 847.5khz) and always begins and ends its responses with sof and eof, respectively. iso/iec 14443 type b-compliant secure memory 28 ______________________________________________________________________________________ abridged data sheet 1st byte 2nd byte 3rd byte, upper nibble 3rd byte, bit 4, bit 3 3rd byte, bit 2, bit 1 bit rate cability maximum frame size, protocol type fwi adc fo 77h 21h 0111b 00b 01b figure 22. protocol info field details command sof crc eof 1dh (2 bytes) pupi (4 bytes) param 1 (1 byte) param 2 (1 byte) param 3 01h param 4 (1 byte) hlinf ( 0 bytes) figure 25. attrib request frame command sof crc eof 50h (2 bytes) pupi (4 bytes) figure 23. hltb request frame indicator sof crc eof 00h (2 bytes) figure 24. hltb response frame
param 2 informs the slave about the data rate that shall be used for communication in the active state and the maximum frame size that the master can receive. figure 26 shows the bit assignments for the param 2 byte. the max66040 supports the data rates of 105.9kbps (code 00b), 211.9kbps (code 01b), 423.75kbps (code 10b), and 847.5kbps (code 11b). the master can choose different data rates for request and response. since it does not support chaining, the max66040 ignores the frame size capability and assumes that the master can receive frames as large as specified in the atqb response. the lower nibble of param 3 is used to confirm the pro- tocol type as specified in the lower nibble of the second byte of the atqb protocol info. since iso/iec 14443-3 sets the upper nibble of param 3 to 0000b, the param 3 value to be used for the max66040 in the attrib request is 01h. param 4 assigns the slave the cid number that is used with the block transmission protocol to address one of several slaves in the active state. figure 27 shows the param 4 bit assignments. since the max66040 sup- ports the cid field, the master can assign any number in the range from 0 to 14. according to iso/iec 14443- 3, code 15 is reserved. the attrib request frame contains one optional field, called higher layer information (hlinf). this field can be used to include data as in the information field of the iso/iec 14443 type b block transmission protocol (see figure 11). if such data is present and the slave sup- ports the hlinf field, then the slave processes the hlinf data and returns the result in its response to the attrib request. typically, the attrib request is trans- mitted without hlinf field. the only hlinf data that the max66040 accepts and processes is the get uid com- mand, code 30h. if the attrib request has a matching pupi and a valid crc, the slave transmits an attrib response frame, as shown in figure 28. the upper nibble of the indicator, also referred to as mbli, is 0000b, telling that the slave does not provide any information on its internal input buffer size; the lower nibble returns the card identifier value that the master has just assigned to the slave. the hl response field is optional. there are three cases to be distinguished: a) if there was no hlinf field in the attrib request, then there is no hl response field in the response. b) if there was a get uid command code (30h) in the hlinf field of the attrib request, then the hl response field is identical to the get uid response information field (i.e., 00h followed by the 8-byte uid). c) if the code in the hlinf field of the attrib request was different from 30h, then the response frame does not contain an hl response field. deselect command the deselect command is used to transition the slave from the active to the halt state after the master has completed the communication with the slave. there are two versions of the deselect request frame, one without cid and one with cid. figure 29 shows both versions. figure 27 shows the cid format. logically, the deselect command is a special case of the s-block of the block transmission protocol, as defined in part 4 of the iso/iec 14443 standard. the max66040 responds to a deselect command if the cid max66040 iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 29 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb xxxx response data rate (uplink) receiver frame size capability response data rate (downlink) figure 26. bit assignments for param 2 byte bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 msb lsb 0 (fixed) card identifier value (cid) 0 00 figure 27. bit assignments for param 4 byte sof frame without cid crc eof (2 bytes) command c2h sof frame with cid crc eof (2 bytes) cid (1 byte) command cah figure 29. deselect request and response frames indicator sof crc eof mbli, cid (2 bytes) hl response ( 0 bytes) figure 28. attrib response frame abridged data sheet
max66040 in the request and the cid in the device match. if the deselect request does not include a cid, the max66040 only responds to the request if its cid is 0000b. the response frame to the deselect command is identical to the request frame. the slave returns the same data that it had received, confirming that the slave addressed in the request has been transitioned to the halt sate. anticollision examples probabilistic anticollision the master starts the anticollision process by issuing an reqb or wupb command. the wupb command involves any slave in the field with a matching afi code. the reqb command performs the same function, but is ignored by slaves in the halt state. both commands include the parameter n, which according to table 15 is used to set the probability of an atqb response to 1/n. if n = 1, all participating slaves respond with the atqb response. if n is greater than one, then each slave selects a random number r in the range of 1 to n. if a slave happens to choose r = 1, then it responds with atqb. if r is greater than 1, then the slave waits for another reqb or wupb command, which causes the participating slaves to choose a new random number r. the atqb response contains a field named pupi, which is used to direct commands to a specific slave during the anticollision process. when the master receives an atqb response, it should issue a matching hltb command to halt the slave or issue a matching attrib command to assign a cid and place the slave in the active state. if this is not done, the slaves con- tinue to participate in the anticollision process. a slave in the active state ignores all reqb, wupb, slot- marker, attrib, and hltb commands, but responds to the deselect command. an atqb response received with a crc error indicates a collision because two or more slaves have responded at the same time. with probabilistic anticollision, the master must issue another reqb command to cause the slaves in the field that are not in the halt or active state to select a new random number r. if one of the slaves has chosen r = 1, it responds with atqb. a reqb without atqb response does not guaran- tee that all slaves in the field have been identified. figure 30 shows an example of the time-slot anticolli- sion, assuming that there are four slaves in idle state in the field. the process begins with the master sending an reqb request with n = 1, which forces all slaves to respond with atqb, resulting in a collision. knowing that slaves are present, the master now sends reqb with n = 8. this causes all slaves to select a random number in the range of 1 to 8. only the slave that has chosen r = 1 responds, which is slave c in the example. knowing that there are more slaves in the field, the master continues issuing reqb commands, which in the example, even- tually identifies all slaves. due to its statistical nature, probabilistic anticollision is less likely to find every slave in the field than the time-slot anticollision. iso/iec 14443 type b-compliant secure memory 30 ______________________________________________________________________________________ abridged data sheet testing for slaves attempt 1 attempt 2 attempt 3 attempt 4 attempt 5 attempt 6 master reqb (n = 1) reqb (n = 8) reqb (n = 8) reqb (n = 8) reqb (n = 8) reqb (n = 8) reqb (n = 8) slave a atqb (r = 3) (r = 7) (r = 1) atqb (r = 3) (r = 6) (r = 8) slave b atqb (r = 6) (r = 4) (r = 8) (r = 8) (r = 5) (r = 1) atqb slave c atqb (r = 1) atqb (r = 8) (r = 2) (r = 4) (r = 3) (r = 4) slave d atqb (r = 2) (r = 1) atqb (r = 5) (r = 8) (r = 4) (r = 2) figure 30. probabilistic anticollision example
time-slot anticollision the master starts the anticollision process by issuing an reqb or wupb command. the wupb command involves any slave in the field with a matching afi code. the reqb command performs the same function, but is ignored by slaves in the halt state. both commands include the parameter n, which according to table 15 specifies the number of slots to be used in the anticolli- sion protocol. if n = 1, all participating slaves respond with the atqb response. if n is greater than one, then each slave selects a random number r in the range of 1 to n. if a slave happens to choose r = 1, then it responds with atqb. if r is greater than 1, then the slave waits for a slot-marker command with a slot number that is equal to r and then responds with atqb. the master must try all slot numbers from 2 to n to ensure that no slave is missed. the atqb response contains a field named pupi, which is used to direct commands to a specific slave during the anticollision process. when the master receives an atqb response, it should issue a matching hltb command to halt the slave, or issue a matching attrib command to assign a cid and place the slave in the active state. a slave in the active state ignores all reqb, wupb, slot-marker, attrib, and hltb commands, but responds to the deselect command. an atqb response received with a crc error indicates a collision because two or more slaves have responded at the same time. typically the master continues issuing slot-marker commands to test for slaves with ran- dom numbers r different from 1. if additional collisions were encountered, the master must issue a new reqb command, causing each slave in the field that is not in the halt or active state to select a new random num- ber r. the anticollision process then continues in this manner until all slaves in the field have been identified and put either into the halt or active state. figure 31 shows an example of the time-slot anticolli- sion, assuming that there are four slaves in idle state in the field. the process begins with the master send- ing an reqb request with n = 1, which forces all slaves to respond with atqb, resulting in a collision. knowing that slaves are present, the master now sends reqb with n = 8. this causes all slaves to select a random number in the range of 1 to 8. this does not prevent two slaves from choosing the same value for r, but the higher n is, the less likely this is to occur. in the exam- ple, slave c has chosen r = 1 and responds right after reqb. the master now sends a slot-marker com- mand with slot number 2 (sm2), which causes slave d to respond. the master continues testing all slots, and, if a slave with matching r is present, receives an atqb. in case the master detects a collision in a slot, the slaves identified in the remaining slots need to be put in the halt or active state first, before another anticollision process is started. note that there is no need for the master to test the slots in numerical order, as in the example. max66040 iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 31 testing for slaves slot 1 slot 2 slot 3 slot 4 slot 5 slot 6 slot 7 slot 8 master reqb (n = 1) reqb (n = 8) sm2 sm3 sm4 sm5 sm6 sm7 sm8 slave a atqb (r = 3) atqb slave b atqb (r = 6) atqb slave c atqb (r = 1) atqb slave d atqb (r = 2) atqb figure 31. time-slot anticollision example abridged data sheet
max66040 iso/iec 14443 type b-compliant secure memory 32 ______________________________________________________________________________________ abridged data sheet figure 32. 8-bit crc generator 1st stage msb lsb 2nd stage 3rd stage 4th stage 7th stage 8th stage 6th stage 5th stage x 0 x 1 x 2 x 3 x 4 polynomial = x 8 + x 5 + x 4 + 1 input data x 5 x 6 x 7 x 8 figure 33. crc-16-ccitt generator 1st stage msb lsb 2nd stage 7th stage 8th stage 6th stage x 0 x 1 3rd stage 4th stage 5th stage x 2 x 3 x 4 polynomial = x 16 + x 12 + x 5 + 1 input data x 5 x 6 11th stage x 11 9th stage 10th stage x 9 x 10 12th stage 15th stage 14th stage 13th stage x 12 x 13 x 14 x 7 16th stage x 16 x 15 x 8 crc generation the max66040 uses two different types of crcs. one crc is an 8-bit type. the equivalent polynomial func- tion of this crc is x 8 + x 5 + x 4 + 1. the other crc is a 16-bit type, generated according to the crc-16-ccitt polynomial function: x 16 + x 12 + x 5 + 1 (figure 33). this crc is used for error detection in request and response data packets and is always communicated in the inverted form. after all data bytes are shifted into the crc generator, the state of the 16 flip-flops is parallel-copied to a shift register and shifted out for transmission with the lsb first. for more details on this crc, refer to iso/iec 14443-3, annex b, crc_b encoding.
max66040 MAX66040K-000aa+ top view side view 54mm 28mm 7.7mm 1.6mm 85.60mm 53.98mm 0.76mm 14.29mm 3.49mm max66040e-000aa+ top view side view key fob iso card mechanical drawings iso/iec 14443 type b-compliant secure memory ______________________________________________________________________________________ 37 abridged data sheet
max66040 iso/iec 14443 type b-compliant secure memory maxim cannot assume responsibility for use of any circuitry other than circuitry entirely embodied in a maxim product. no circu it patent licenses are implied. maxim reserves the right to change the circuitry and specifications without notice at any time. 38 ____________________maxim integrated products, 120 san gabriel drive, sunnyvale, ca 94086 408-737-7600 2011 maxim integrated products maxim is a registered trademark of maxim integrated products, inc. abridged data sheet revision history revision number revision date description pages changed 0 1/11 initial release

▲Up To Search▲

Price & Availability of MAX66040K

	To Download MAX66040K Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .